0x1a0 [ 905.327401][T28806] ? ksys_write+0x237/0x2a0 [ 905.331877][T28806] ? __x64_sys_splice+0xf0/0xf0 [ 905.336710][T28806] ? __x64_sys_splice+0x1d/0xf0 [ 905.341531][T28806] do_syscall_64+0xcb/0x150 [ 905.346006][T28806] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 905.351867][T28806] RIP: 0033:0x45d5b9 [ 905.355736][T28806] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 905.375323][T28806] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 905.383711][T28806] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 22:55:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 905.391652][T28806] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 905.399594][T28806] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 905.407537][T28806] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015 [ 905.415480][T28806] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:20 executing program 4: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(0x0, 0xee01, r1) r2 = syz_mount_image$vfat(&(0x7f0000000200)='vfat\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x0, &(0x7f0000000000), 0x1090c00, &(0x7f0000000040)={[{@shortname_win95='shortname=win95'}, {@numtail='nonumtail=0'}]}) fcntl$getflags(r2, 0x40a) 22:55:20 executing program 4: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001000010800"/19, @ANYRES32=0x0, @ANYBLOB="000500000088001b000000000000003a"], 0x28}}, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2e, &(0x7f0000000140)={0x0, {{0x2, 0x0, @multicast1=0xe0000500}}, {{0x2, 0x0, @loopback}}}, 0x108) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000001000"/20, @ANYRES32=0x0, @ANYBLOB="030200000000000008001b0000000000"], 0x28}, 0x339}, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000040)={&(0x7f0000000000)=""/60, 0x200000, 0x3800, 0x94, 0x5}, 0x20) 22:55:20 executing program 4: syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)={{0x12, 0x1, 0x0, 0xc8, 0x8b, 0x94, 0x10, 0x944, 0x201, 0x5545, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff, 0x44, 0xaa}}]}}]}}, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) ioctl$RTC_PLL_GET(r1, 0x80207011, &(0x7f0000000100)) fcntl$setpipe(r0, 0x407, 0x0) sendmsg$AUDIT_SET_FEATURE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x3fa, 0x200, 0x70bd2a, 0x25dfdbfd, {0x1, 0x1, 0x1}, ["", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x20004975}, 0x4000) [ 905.452842][T28810] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 905.492084][T28816] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 22:55:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 905.502315][T28817] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 905.563077][T28822] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 905.683227][T28825] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x95010000}, 0x2}], 0x1, 0x2, 0x0) 22:55:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 905.787431][ T4047] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 905.798298][T28832] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:20 executing program 0 (fault-call:12 fault-nth:22): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:20 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 905.891338][T28838] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 905.962684][T28841] FAULT_INJECTION: forcing a failure. [ 905.962684][T28841] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 905.975876][T28841] CPU: 1 PID: 28841 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 905.986025][T28841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 905.996051][T28841] Call Trace: [ 905.999316][T28841] dump_stack+0x1b0/0x21e [ 906.003626][T28841] ? devkmsg_release+0x11c/0x11c [ 906.008535][T28841] ? arch_stack_walk+0x98/0xe0 [ 906.013264][T28841] ? show_regs_print_info+0x12/0x12 [ 906.018429][T28841] should_fail+0x6fb/0x860 [ 906.022813][T28841] ? setup_fault_attr+0x2b0/0x2b0 [ 906.027807][T28841] __alloc_pages_nodemask+0x1ee/0x7c0 [ 906.033147][T28841] ? kmem_cache_alloc+0x1d5/0x250 [ 906.038149][T28841] ? __napi_alloc_skb+0xd6/0x520 [ 906.043053][T28841] ? gfp_pfmemalloc_allowed+0x130/0x130 [ 906.048567][T28841] ? __kernel_write+0x12c/0x340 [ 906.053385][T28841] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 906.059421][T28841] ? __rcu_read_lock+0x50/0x50 [ 906.064152][T28841] alloc_slab_page+0x3a/0x390 [ 906.068797][T28841] new_slab+0x97/0x450 [ 906.072833][T28841] ? should_fail+0x182/0x860 [ 906.077408][T28841] ___slab_alloc+0x2e0/0x450 [ 906.081980][T28841] ? setup_fault_attr+0x2b0/0x2b0 [ 906.086987][T28841] ? eth_get_headlen+0x240/0x240 [ 906.091891][T28841] ? tun_get_user+0xc08/0x3400 [ 906.096631][T28841] ? tun_get_user+0xc08/0x3400 [ 906.101362][T28841] __kmalloc_track_caller+0x288/0x2b0 [ 906.106709][T28841] ? __napi_alloc_skb+0xd6/0x520 [ 906.111621][T28841] ? tun_get_user+0xc08/0x3400 [ 906.116366][T28841] pskb_expand_head+0x10d/0xfb0 [ 906.121202][T28841] tun_get_user+0xc08/0x3400 [ 906.125774][T28841] ? tun_do_read+0x1f10/0x1f10 [ 906.130508][T28841] ? unwind_get_return_address_ptr+0x130/0x130 [ 906.136628][T28841] ? memset+0x1f/0x40 [ 906.140585][T28841] ? unwind_next_frame+0x1c07/0x22b0 [ 906.145846][T28841] ? __rcu_read_lock+0x50/0x50 [ 906.150577][T28841] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 906.156619][T28841] tun_chr_write_iter+0x121/0x1a0 [ 906.161615][T28841] __vfs_write+0x579/0x700 [ 906.166003][T28841] ? __kernel_write+0x340/0x340 [ 906.170831][T28841] ? __kernel_text_address+0x93/0x110 [ 906.176177][T28841] ? stack_trace_save+0x111/0x1e0 [ 906.181170][T28841] __kernel_write+0x12c/0x340 [ 906.185814][T28841] write_pipe_buf+0x148/0x1d0 [ 906.190459][T28841] ? default_file_splice_write+0x240/0x240 [ 906.196238][T28841] ? __rcu_read_lock+0x50/0x50 [ 906.200967][T28841] __splice_from_pipe+0x2d3/0x870 [ 906.205956][T28841] ? default_file_splice_write+0x240/0x240 [ 906.211726][T28841] default_file_splice_write+0x179/0x240 [ 906.217324][T28841] ? default_file_splice_read+0x920/0x920 [ 906.223015][T28841] ? avc_policy_seqno+0x17/0x70 [ 906.227834][T28841] ? security_file_permission+0x128/0x300 [ 906.233535][T28841] ? default_file_splice_read+0x920/0x920 [ 906.239222][T28841] __se_sys_splice+0x860/0x1b90 [ 906.244047][T28841] ? security_file_permission+0x128/0x300 [ 906.249741][T28841] ? fput_many+0x42/0x1a0 [ 906.254056][T28841] ? ksys_write+0x237/0x2a0 [ 906.258524][T28841] ? __x64_sys_splice+0xf0/0xf0 [ 906.263341][T28841] ? __x64_sys_splice+0x1d/0xf0 [ 906.268166][T28841] do_syscall_64+0xcb/0x150 [ 906.272647][T28841] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 906.278506][T28841] RIP: 0033:0x45d5b9 [ 906.282375][T28841] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 906.301960][T28841] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:55:21 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) read$usbfs(r3, &(0x7f00000000c0)=""/64, 0x40) close(r2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 906.310340][T28841] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 906.318343][T28841] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 906.326290][T28841] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 906.334241][T28841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000016 [ 906.342187][T28841] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 906.394741][T28847] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 906.401989][ T4047] usb 5-1: Using ep0 maxpacket: 16 22:55:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 906.503635][T28850] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 906.604239][T28855] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 906.717443][ T4047] usb 5-1: New USB device found, idVendor=0944, idProduct=0201, bcdDevice=55.45 [ 906.726516][ T4047] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 906.735401][ T4047] usb 5-1: Product: syz [ 906.740075][ T4047] usb 5-1: Manufacturer: syz [ 906.745379][ T4047] usb 5-1: SerialNumber: syz [ 906.752787][ T4047] usb 5-1: config 0 descriptor?? [ 906.998654][ T3038] usb 5-1: USB disconnect, device number 54 [ 907.767310][ T3038] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 908.007313][ T3038] usb 5-1: Using ep0 maxpacket: 16 [ 908.287344][ T3038] usb 5-1: New USB device found, idVendor=0944, idProduct=0201, bcdDevice=55.45 [ 908.296396][ T3038] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 908.304924][ T3038] usb 5-1: Product: syz [ 908.309339][ T3038] usb 5-1: Manufacturer: syz [ 908.313918][ T3038] usb 5-1: SerialNumber: syz [ 908.319453][ T3038] usb 5-1: config 0 descriptor?? 22:55:23 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r3 = fcntl$dupfd(r2, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000080)="3100000012000900690006342f17e70000c74408100000e446005c79cbb900540d03c000ec192dced88d5d5ae1673653b6", 0x31}], 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="5c000000140001000000000000000000fc020000000000000000000000000000ffffffff00"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="0046030000002a7be000"], 0x5c}, 0x8}, 0x0) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000340)={0xfff, 0x7f, 0x5, 0x0, 0x4, [{0x798f, 0x498, 0x3, [], 0x802}, {0x36f2, 0x400, 0x100}, {0x7f, 0x7}, {0x83d, 0x9, 0x6e, [], 0x180e}]}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fsync(r0) fcntl$setpipe(r5, 0x407, 0x0) setsockopt$inet6_mtu(r5, 0x29, 0x17, &(0x7f0000000100)=0x2, 0x4) 22:55:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x9bc42000}, 0x2}], 0x1, 0x2, 0x0) 22:55:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:23 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a5693800"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:23 executing program 0 (fault-call:12 fault-nth:23): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:23 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000140)={0x0, @loopback, @empty}, 0xc) r3 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0xab3c, 0x400) mmap$usbfs(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x300001e, 0x40010, r3, 0x7) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYRESHEX=r6], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = dup(r7) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000), 0x0, 0x4) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r9, 0x8982, &(0x7f0000000180)={0x6, 'syzkaller0\x00', {0x20000}, 0x82}) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r4, 0x0, 0x18100, 0x0) [ 908.523934][ T3038] usb 5-1: USB disconnect, device number 55 22:55:23 executing program 4: openat$rfkill(0xffffffffffffff9c, &(0x7f0000000380)='/dev/rfkill\x00', 0x30180, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/hwrng\x00', 0x10140, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@l2={0x1f, 0x4, @none, 0x1, 0x1}, 0x80) getsockname$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) ioctl$MON_IOCT_RING_SIZE(r0, 0x9204, 0x2000000e92f4) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000280)={'ip6_vti0\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x4, 0x3, 0x15, 0x3ff, 0x49, @local, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8, 0x700, 0xfff, 0xfffffff8}}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) finit_module(r0, &(0x7f00000001c0)='#%,,\'&<]\\\x00', 0x1) fcntl$setpipe(r4, 0x407, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000002d00000226bd7000fbdbdf25000000002031eb131249af6fa1d68f9a29018ff3bf29afc4e19202f1bb1d22caf3430978721bf130cb203436b32e5b6cd9d0073f8c52a08d5fea8c2beefb9dc1dc16614070d745d8af06ec2d520e091145e712e4704b459a5b36ff1dc8ed18f113077f6682715991d95136fc0f768ebf793b0502a2deeecb47", @ANYRES32=r3, @ANYBLOB="09000c000c00e0ffffff0f0008000b00faffffff06000500030400000600050081840000"], 0x3c}}, 0x0) r5 = open(&(0x7f00000002c0)='./file0\x00', 0x4000, 0x152) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x18, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="b4f30000000100000000003bfb00e100"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x40f00, 0xa, [], r2, 0x0, r5, 0x8, &(0x7f0000000140), 0x8, 0x10, &(0x7f0000000080)={0x0, 0x4}, 0x10}, 0x78) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000100)) socket$nl_generic(0x10, 0x3, 0x10) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, &(0x7f0000000340)) ioctl$TUNGETFEATURES(0xffffffffffffffff, 0x800454cf, &(0x7f00000000c0)) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180)='NLBL_UNLBL\x00') [ 908.587694][T28879] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 908.597031][T28879] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.4'. [ 908.611109][T28882] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.4'. [ 908.621535][T28882] netlink: 9 bytes leftover after parsing attributes in process `syz-executor.4'. [ 908.632230][T28875] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 908.666359][T28873] FAULT_INJECTION: forcing a failure. [ 908.666359][T28873] name failslab, interval 1, probability 0, space 0, times 0 [ 908.679438][T28873] CPU: 1 PID: 28873 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 908.689580][T28873] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 908.699609][T28873] Call Trace: [ 908.702871][T28873] dump_stack+0x1b0/0x21e [ 908.707173][T28873] ? devkmsg_release+0x11c/0x11c [ 908.712078][T28873] ? show_regs_print_info+0x12/0x12 [ 908.717244][T28873] ? ktime_get_with_offset+0x186/0x1c0 [ 908.722670][T28873] ? _raw_spin_lock+0xa1/0x170 [ 908.727400][T28873] should_fail+0x6fb/0x860 [ 908.731782][T28873] ? setup_fault_attr+0x2b0/0x2b0 [ 908.736774][T28873] ? ___slab_alloc+0x297/0x450 [ 908.741507][T28873] ? tun_get_user+0xc08/0x3400 [ 908.746235][T28873] should_failslab+0x5/0x20 [ 908.750705][T28873] __kmalloc_track_caller+0x5d/0x2b0 [ 908.755959][T28873] ? __napi_alloc_skb+0xd6/0x520 [ 908.760880][T28873] ? tun_get_user+0xc08/0x3400 [ 908.765608][T28873] pskb_expand_head+0x10d/0xfb0 [ 908.770426][T28873] tun_get_user+0xc08/0x3400 [ 908.774986][T28873] ? tun_do_read+0x1f10/0x1f10 [ 908.779734][T28873] ? unwind_get_return_address_ptr+0x130/0x130 [ 908.785856][T28873] ? memset+0x1f/0x40 [ 908.789806][T28873] ? unwind_next_frame+0x1c07/0x22b0 [ 908.795058][T28873] ? __rcu_read_lock+0x50/0x50 [ 908.799790][T28873] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 908.805824][T28873] tun_chr_write_iter+0x121/0x1a0 [ 908.810816][T28873] __vfs_write+0x579/0x700 [ 908.815201][T28873] ? __kernel_write+0x340/0x340 [ 908.820017][T28873] ? __kernel_text_address+0x93/0x110 [ 908.825362][T28873] ? stack_trace_save+0x111/0x1e0 [ 908.830383][T28873] __kernel_write+0x12c/0x340 [ 908.835027][T28873] write_pipe_buf+0x148/0x1d0 [ 908.839670][T28873] ? default_file_splice_write+0x240/0x240 [ 908.845452][T28873] ? __rcu_read_lock+0x50/0x50 [ 908.850183][T28873] __splice_from_pipe+0x2d3/0x870 [ 908.855188][T28873] ? default_file_splice_write+0x240/0x240 [ 908.860978][T28873] default_file_splice_write+0x179/0x240 [ 908.866575][T28873] ? default_file_splice_read+0x920/0x920 [ 908.872259][T28873] ? avc_policy_seqno+0x17/0x70 [ 908.877089][T28873] ? security_file_permission+0x128/0x300 [ 908.882785][T28873] ? default_file_splice_read+0x920/0x920 [ 908.888468][T28873] __se_sys_splice+0x860/0x1b90 [ 908.893285][T28873] ? security_file_permission+0x128/0x300 [ 908.898969][T28873] ? fput_many+0x42/0x1a0 [ 908.903267][T28873] ? ksys_write+0x237/0x2a0 [ 908.907737][T28873] ? __x64_sys_splice+0xf0/0xf0 [ 908.912554][T28873] ? __x64_sys_splice+0x1d/0xf0 [ 908.917370][T28873] do_syscall_64+0xcb/0x150 [ 908.921844][T28873] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 908.927703][T28873] RIP: 0033:0x45d5b9 [ 908.931581][T28873] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 908.951150][T28873] RSP: 002b:00007f46bb9d4c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 908.959526][T28873] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 908.967465][T28873] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 908.975406][T28873] RBP: 00007f46bb9d4ca0 R08: 0000000000018100 R09: 0000000000000000 [ 908.983358][T28873] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000017 [ 908.991298][T28873] R13: 00007ffebf76999f R14: 00007f46bb9d59c0 R15: 000000000118cf4c 22:55:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:23 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 909.071626][T28892] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 909.182932][T28897] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:24 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 909.292187][T28902] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xe8030000}, 0x2}], 0x1, 0x2, 0x0) 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:24 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a5693800"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:24 executing program 0 (fault-call:12 fault-nth:24): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:24 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x30, r7, 0x1, 0x0, 0x0, {{}, {}, {0xf}}}, 0x30}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r5, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r7, 0x4, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411b432fbb35b31e3b870246a2e3733812e01ce78d58e85d53eb6f0abfcc764a44937f3c3114a4081f6ca24f66689f7edb43cb78ea4dd3cd4de6e2631890f7e11f1860945a53cacec78e645ee3082d018119fea324524b3a91ea1ebfa23a5f989fe092c23318b93a23e18ab9ffc43708d9fa10ca7ea15490e2545e1b5894c87ac2bebb324c015f42addf7f91e6454878a8a256b5c8ebc389d169b914603d9768c0c6b80969d73c35ccd64a55a000b80c362b1eb19389cbde574223e39ea6ad79fce4087bbfd2059d08fbfbe5c80213ad9612221cae425ecc26df095e21cb1a0e3b5d7dadb324a71dbbba3a1843c00000000"], 0x9e) sendmsg$IPSET_CMD_SAVE(r0, &(0x7f0000000540)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000340)={&(0x7f00000004c0)={0x54, 0x8, 0x6, 0x301, 0x0, 0x0, {0x7, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4080}, 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup(r8) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f00000002c0)=ANY=[@ANYRES16=r2, @ANYBLOB="f5660b483982caa1ab93d2456064a0d4e8a60000000000"], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:24 executing program 4: r0 = syz_mount_image$msdos(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount(&(0x7f0000000240)=@loop={'/dev/loop', 0x0}, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='msdos\x00', 0x0, 0x0) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000300)={{r0}, 0x0, 0x2, @unused=[0x7f, 0x0, 0x4, 0xcc], @name="63df19b060d1460d380f5b381693da653e1609c47759f2118913ff97158d95a056b1c110f802f70f4a59e41f8eec3c925865229d44322c1a62e429f48239e7f67250a90cec34b44c5ee314f68d999af42b25383b0e3a7f41ca5b09bb5ce80b4e3e308c22aafac2f7a802b0094ab7502f22b4cd7b1cc3d72d7798ad75ed28451821a5543f93b3529785ae57743c2b50fcdb97ebc156ac4432b896462db7a52cf4fbacc54fa78e0adafbadfafca4bdee3ca5ed7e6037978167ae9a8ed58f8e86331802f947da71da4af2dedbd4da7d2fc5a4aa42c64980a12e7a0c63f51448c3519d3d581f0d3cec37cc105c70e5484685bd77ac7bce108f404aa46c3726a268e697c02a4ea1dad24c27a581378b21e9ead4463eb866984566545ee34bbe26f3c0a8e171afeeeeb9a8500f35d9b7938a4bf2f489abf9622b8602fba914cd2b94444a4389ee3c84525e0575f772a3f1dbbe860c79aa9be0f4defc22c4a7f97e55b817f6187c4486ac9b33fb262af0939c3aa9aa095d29e986149835619a9576a54ccce391e3dd5c34ae725048b3611b7b532132ea3b5278249ddc1f0a8d735af33d15ccaaf240bc2fb58b496f4b305a841ac0439ccfe8a0e040d70b2389bc1df85dddc54dc0a94f6a175a95512db04c8857fc9500d74d8aa366c65ac4e6bce69a0bd9f3a74fbded68b344c024df2fb22f9630d2f8faccb54d44f0bb1e5f163559a8acac630ecc96721f4e487a5c765dbe265b2d67396e6549f0f0e16f9c8ed3aa53e5ebb34dd970245c45931d6b09a88c11b8e3515729fa9ccee61b0e060be7b40a662f8c53e1f7cc23ade18111af56862b05660c20e4263afa47482c0cdd110d3e9d9fbcd97be2ee2ced575bda3ad3e393ce20ba8fd6369836ae32923bb88533f2eb6bba026021f9d16e7c55ef87d208feb1ef81d5160a7796939b45caed4912eea4cb3ed77007c48280f01697260e4f1f634e07b92cc0fef9109505cc343ca8c24a4d6547caab98884387146d410d4c1a12ab416984807ce2b0070a3e56f565a9fc51d4938ba02128141dcf00110ce375a3c4b4fefb011f21498aeedc855ba72a43f5229f89d78f49f1ebb8c21c0471ff962a0d9aa64efe21b9dd1e0aeafc90d729557441ab49b03ccfccb6491abe994ffd28b2fcce7b9e9f68a98832b3ccf92a4f11025e93163169df438bf44e526c718113aa5b63703817c71a18a8b4183d1dec30b5aefab67361a0c97fb82dc7fce184dc582371c149428bd1a319012e948c743fd0a97e90dfe845e30b4acf42d126e77517b4658ba7fbcc1890231a1b1753423addbe5a69697d0c8a0ee9bcc80798fa1d75dab864e5c1a545980f167cc666157bcb4c40d95b32f437c0f55fd176526c54aa8f3151c030bea422aae3e65919fea38f1fc6b92fee32f8bb6b5ad24986dce78c270caf3dfd481fab425b054af8424eb7f5bb2ab7ab6ab9d61f360975686edfc50a4069186654147575e015614fc5e3ebb6ea106659b60b0ace5673538d6c292cc2cb4fb0769793b27230b4ca7243a5776fe9372fe2608d89b7e5e2632afc480ccf13e15a2224fda2a129a8fb181ee52277f1d690866042778f05733f984a536a241344a763430f660e8bd81ae1cd382a3294961d8fd5a93cacc28d404d6fc697faa31a5fc50454ea1731844d375574c8f8ac31ae55dd4e2a4079a1471db94e5bc1e49563b1c53996ecfac906a538b7f6f1bca691d3180120d2e3f90f9586cf0ba283d80f09648672787b93c362bd27560bb02a232fac1494a97dece40b088079a6293d4fc28a78c3a9b56cc0ed521bbefd2ed032beee5fb6d250aa24ae474907e4b5ba24c84070860b5bdfcbbfb5d3268fb6d8f25bed6982b6832c3073fb074d6f3766f21660c04a60c4bb1c50de41bdb862ec77c5946694c47f132a6d37f8a373710958786d4f6a0e128c0da61f1ee895a7a32b4c0eddc0bfa59ba892422b80c8c5f0f84a637e4c618b964b68edbf94166ec4807630fa5880cc2428180a7f35f8ae333686385edbf079bcb88f5e71242a10d5833e089048396a9df6cf4b00cf2c69e4497670f6f6df58b7be334d6efd567858f7047a44f1c4b4f6ab8b8190db68b305e91da4bc1b2101788683d55679893262c155ed70d142bb4db9abd8d4dbbc965826ef473d37afc5943f2746e63fd31092ba5c4c99617f71bc04ba0ac7f577611492d804866ecc4e17113929129648bd10ec18ff0166e6dcd2323814606257e17609b1001014669ddc462f178b2614286655250f1c2ca4320d42f9376a68c967a0eac0e43fa8f0caca0c6cbbefed5e9e29b4c332436ea11887f47b86e52928ffbf0a80618353a1d507eb6d762ee26ad82c49ae556e4ca2d4df23b7921a8160651e3a170ae36c893596976bbd82ee1e2fdd159614c116c0d2dce6b5d86a41380c6bf7a83cab3271e266b614b56d78c103f96ba9b8e785fc52984f0986b893119b20bb3b13e0537c9dced878c3abc36ffed194bfc6e168ddaf42c5f54a6c501ca49128c6a9d78702c609840f1fa1cd88ed45ae033e717db1500cb2f975a1a8246974438096e3855c4978613c7201b9b21df3e7abd9245952c65dac970935b41a21cd19509f727ae2799f35ef5f6a6b138204a6b6c595b9915282e74faf90324f517829df9dd2c5e110f2fb9414f668979a9a5ed91f9a12f99aee7853b6c3d3a219c2f1f533b84eca80e447aa4fad75df01f11bf8eae439d6cd057be675c39d1ad1cb42aa6fa0ce115ef12f01f850d2e34ddde4cf7e9fa7ec9c5f04ce6460f66027885683e57ed0284de08306d3c000e8dc38b80686fc6bd80d8af8f94036353eb1fb44cf27044910929d013dc81bce01d51b96eb356c611fa1c5e7e3f7f8a471a33557cd1da2d1e19a67d224676f9761f228cf3156f111f2a0bcd8cf10efcd366d37bc1ef93550d6680f3fff6872f8217c6078bec487a73952f403e3cd4d696cb807108c67f4455bcb4ce181ee82bfe77de22207c071b4362f334a0dc43b26026ca8f4edf3fc447e2592a92d36ee6442e20cd57578ff52379e14ad065c0a6dc9ab2c7262608e666010ab27a2664d0c91b205dbf1f6999e2a9cb21c5b0ab20556560ba21b08fe4ad6b3143592729bd7c68126f152c69c44011fa0eb676c61193a83389dc80f268f71b7a8ccbfbd51bf9489db4b89c7531fe8b0425b09ecfde9ffa8e6b81989da9d40dff8f86e2723a00e6afaaa993e74a71eefb55593574a7b33201033a1cea2f596b63831a466e617d44fb9cb6c8e3363a3be801caa8fa9a7a4cdead10bdd8863f35856d18d3c88b0d130d9e074067e31a36eb719c6b8fb849341379b8c9f180445082b6dc78e90bd683d4dc6d76dcfd2f59d91422bed3f9f6379a5a8cbdf48737b3fb3436aaf92c314481aac325f71ad958ad78b1ecfde13cdb6268c6b59fe5b9cafff511f0715bc8bbd93d74c87bae02cbebc4331d71a672d5ecc567b64717b18cad2a27bc676c5875afcc168b0c18f9d599a63e423a4ea293faa068e258c7d54f41a35ff5dd4f8b4d4e211bc6321202a602ffc828391f4d8577bd07e41161ea0cdf8ecaab761ddeaf1c3dea3fdc3b06b465bdf6d32c53d72daada4193a0c86050f1fb64ee42a2dc81104dfb140768e92f6ba0795055c463f5ca53cb1ea5f5cb0844287f06a909183dc85f058084861707e505011c372c662cc74a808794f8fc3416ff4e2e186fc59afd823d1f80038a60aef0f64c03302609d951ae47a3eb16c5d6fb5a99b84a1928c48d7ffbdf03a1438188353597dc9314b0439a567b04715a5cad7f391c8ff8f2d2fe451f20137ae91b3e21e6d71827592ce1f3e40cd15ac79a03e32b49602e40f81d316ec19a7aa4c15e067b6ed7832304eeab564f540b53002c899d387e6cd3514207f8d78c41c69a1219209cb9ea4e04745724aca8231d688d162d08f22a7de326dc718e041bb53e954f75cbcb833f593dee7a1489a63807bee51080a8bbe99cbff6bb57e0ea5a6fb8622affd64b100aeccefd8d0e8453bc27ac5e6c5f0d01ba72e03050a480df3df4c73ee538f396a959f7932a688406977bf77356480315c760ee67d216d7e7896034c2c5dba1c69e279f273ee97eede3c94754bd70751196901a918dde270ed7a1a455242286f7c5d54b48820e4936b09a6c0dc0a4efa0a2c793f249854b6cdbe9090ef155b40c7c9bb8469f74640d9fe7b71af2adabfc259a68d0e13c2b33dbbcc2b7253fa7b8ab84db35f6094e75e8f7f8ffa7a02c04cdc814926128bcb8dbb209878e7549df3c27f797ee914741bbac029a7c6565b37b893cc2c2bf641ee19b9a97d37bc817334add13894f90b8df5651a6d22441330b7fc8fa830e5f3fee36011f6f334ca699f5a24f833d302c0dcfae4f6a8b23893126a3011f8fa49753745fd56da9e474bec26701923ab1505e08a03d4cb3e81fd49389d3ce212ce9c48e4f23c72d75ade019048f303267d9d2ee4e7765a25cb214993ba6901808da8e6d199d1921763f7561aec08758e66b2746a84d5e4c605f46cb65dfce99162e3bb1b6a32a36c1b6eb234f28eb35c9526c2a07217ec6f0a18eb9ab385a19d512fe9633ba5b18b7855dd3d20ccc0801f23f26567b013e586c462b80aa39974ccffe1e3d90cc3ab4dc58581e9fa6e28309565afb260787682ccd813727ab597a527fed92e9b293ce92a57f7d49942d770e12c4c6d407f1ccc03474b9aeae03e45216d5d1c07e65474621a6c6084e9e615f5c67d3498dcc06adf891fe89cbd4f3ca4e16e04af954d937fd884b5fa932ad0d14799158d79817c7ab9b33f515bdefefe59d7e7c08cfe3415db30d9e5d746924a8a9aedfcc8317026de6d45c702a8cd78245194e5da0b267aed386c8a5247bb4f23abb85fc262320b255920f751828146fee759d8651e319a94e6e804852afad9a33250cfb2d4c9917d99b113fc32d42c2a0ecdcfd209d8ed92dd0da11c907c8dc45eae13ac03a4e1578755fdae316e993d38b8aad88362e41816402a882cdfd6a5a1bfe35abdb67a3ec4a6824e24f5ee26f59fc8bbb83d4c885c7d6ac1f671a4a270885875e9fe42d0e405e75cf5152bad57bec13bfaa78550faaafa7fc79dd5a1fd57960aa6a151e364937210b473d1165ef61bed7ab42c5f039dd1b1316bf7650b15cb06f0844b13a5b0e1f0d518ea8af0174c4afbf5b1288aecd34a666cf36374450904a02eeb116bd90acbca4476aa9c90e130939b10800265799a0468a97308483d98139e38e51d4965849bbcf394200292fd0aae1e32967343a2668861d102bc2416e61b7ad23123cb1653c643be956fc3a60db3ca22c68db53a79d00310128527f59e2a22814c470f22a939625e5e30412a10fafafc4490ca8c15e3e204c20e9c71dd77cf9b761329bceb109af110d46250752c68af315359dee34bb78f990c8b37c6d129e63ce11f0712255a07de153ae3ed3fdc80f0b0c6687b1907911507d2a7c2be093d5a9e436f4bc67eb87a091a42586c26d3cc5e019a404ad981c9be6e9170478c40d27e5368565869d193a63f07f01adc42e73ff2b961b64436f831966916fe3dfcc275cc119088da507f7c2b5e7902495871f0c2f1e1bf0bf4de346da29a722430689f22c9d7a94a1877b7dd8a2b9377bd9b17dd8f556c038daaae7c147a8467d271e7ce22a064e239b8c249234afbf7abac17fa11a99d51deab9138f416339138688d"}) [ 909.405558][T28911] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x1eb7a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_STOP_AP(0xffffffffffffffff, 0x0, 0x20000000) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='lowerdir=bus,workdir=./file1,upperdir=./file0']) chdir(&(0x7f0000000140)='./bus\x00') perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080), 0x2}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffbfffffffffff, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) write$nbd(r0, &(0x7f0000000340)=ANY=[], 0x4b) sendfile(r0, r0, &(0x7f0000000200), 0xa198) 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000280)) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:24 executing program 4: r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x4404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x84}}, 0x0) r2 = dup3(r0, r1, 0x80000) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040)='devlink\x00') sendmsg$DEVLINK_CMD_PORT_SPLIT(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=ANY=[@ANYBLOB="6d0400008a3387f15d890c7759db23ce39c99d08", @ANYRES16=r3, @ANYBLOB="080026bd7000ffdbdf25090000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000300020000000800090002000000"], 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) syz_open_dev$mouse(&(0x7f0000000340)='/dev/input/mouse#\x00', 0x4, 0x48140) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x1a404, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) r5 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write$9p(r4, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r6, 0x407, 0x0) sendmsg$AUDIT_GET_FEATURE(r6, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x10, 0x3fb, 0x20, 0x70bd2d, 0x25dfdbfe, "", ["", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x80}, 0x40054) ioctl$KDFONTOP_COPY(r4, 0x4b72, 0x0) sendfile(r4, r5, 0x0, 0x1c542) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) [ 909.554804][T28925] overlayfs: './file0' not a directory [ 909.562844][T28924] FAULT_INJECTION: forcing a failure. [ 909.562844][T28924] name failslab, interval 1, probability 0, space 0, times 0 [ 909.575476][T28924] CPU: 0 PID: 28924 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 909.585610][T28924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 909.595647][T28924] Call Trace: [ 909.598910][T28924] dump_stack+0x1b0/0x21e [ 909.603212][T28924] ? devkmsg_release+0x11c/0x11c [ 909.608118][T28924] ? show_regs_print_info+0x12/0x12 [ 909.613346][T28924] ? _raw_spin_lock+0xa1/0x170 [ 909.618080][T28924] ? _raw_spin_trylock_bh+0x190/0x190 [ 909.623504][T28924] ? _raw_spin_lock+0xa1/0x170 [ 909.628245][T28924] ? _raw_spin_trylock_bh+0x190/0x190 [ 909.633595][T28924] ? netif_receive_skb_list_internal+0x46a/0x720 [ 909.639896][T28924] should_fail+0x6fb/0x860 [ 909.644280][T28924] ? setup_fault_attr+0x2b0/0x2b0 [ 909.649280][T28924] ? eth_get_headlen+0x240/0x240 [ 909.654202][T28924] ? iov_iter_advance+0x707/0xee0 [ 909.659201][T28924] ? __napi_alloc_skb+0xd6/0x520 [ 909.664116][T28924] should_failslab+0x5/0x20 [ 909.668593][T28924] kmem_cache_alloc+0x36/0x250 [ 909.673341][T28924] __napi_alloc_skb+0xd6/0x520 [ 909.678074][T28924] napi_get_frags+0x5c/0x100 [ 909.682635][T28924] tun_get_user+0x9ce/0x3400 [ 909.687195][T28924] ? tun_do_read+0x1f10/0x1f10 [ 909.691929][T28924] ? unwind_get_return_address_ptr+0x130/0x130 [ 909.698051][T28924] ? memset+0x1f/0x40 [ 909.702006][T28924] ? unwind_next_frame+0x1c07/0x22b0 [ 909.707258][T28924] ? __rcu_read_lock+0x50/0x50 [ 909.711990][T28924] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 909.718025][T28924] tun_chr_write_iter+0x121/0x1a0 [ 909.723017][T28924] __vfs_write+0x579/0x700 [ 909.727402][T28924] ? __kernel_write+0x340/0x340 [ 909.732220][T28924] ? __kernel_text_address+0x93/0x110 [ 909.737561][T28924] ? stack_trace_save+0x111/0x1e0 [ 909.742640][T28924] __kernel_write+0x12c/0x340 [ 909.747286][T28924] write_pipe_buf+0x148/0x1d0 [ 909.751929][T28924] ? default_file_splice_write+0x240/0x240 [ 909.757704][T28924] ? __rcu_read_lock+0x50/0x50 [ 909.762434][T28924] __splice_from_pipe+0x2d3/0x870 [ 909.767426][T28924] ? default_file_splice_write+0x240/0x240 [ 909.773199][T28924] default_file_splice_write+0x179/0x240 [ 909.778797][T28924] ? default_file_splice_read+0x920/0x920 [ 909.784482][T28924] ? avc_policy_seqno+0x17/0x70 [ 909.789303][T28924] ? security_file_permission+0x128/0x300 [ 909.794988][T28924] ? default_file_splice_read+0x920/0x920 [ 909.800684][T28924] __se_sys_splice+0x860/0x1b90 [ 909.805504][T28924] ? security_file_permission+0x128/0x300 [ 909.811190][T28924] ? fput_many+0x42/0x1a0 [ 909.815487][T28924] ? ksys_write+0x237/0x2a0 [ 909.819956][T28924] ? __x64_sys_splice+0xf0/0xf0 [ 909.824775][T28924] ? __x64_sys_splice+0x1d/0xf0 [ 909.829592][T28924] do_syscall_64+0xcb/0x150 [ 909.834064][T28924] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 909.839923][T28924] RIP: 0033:0x45d5b9 [ 909.843785][T28924] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 909.863357][T28924] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 909.871733][T28924] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 909.879672][T28924] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 909.887611][T28924] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 909.895551][T28924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018 [ 909.903508][T28924] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 909.922460][T28932] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000280)) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 910.018748][T28938] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, 0x0, &(0x7f0000000280)) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xf4010000}, 0x2}], 0x1, 0x2, 0x0) [ 910.122771][T28942] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:25 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x400000000000ad}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000008c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) syz_open_dev$evdev(&(0x7f0000000180)='/dev/input/event#\x00', 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000580)="9d335359229fb8109bc194fa59cd7eb0b61121f47eeb1ed25123345356fd05f0500f8da8181a2d47e27bd168d59feace0a7b712b5a40d5840bdbbee333940c389951e087dfa6a00000bb6a70b0e381ae555c7cb9e8d1a6b125a3bea092a6925bb8c3733817aae7fdf474e9e82235e34b13bdeb3fdb3b310aeeee90f52549498a343c75c1ecdc4325ff0cd05ba9b51e2649262d25431a19bbf9ac941eecad9300cd3fbaaf49ead47387b5c6fb00b89fd5ad5ad4dfa27808548a7fe2f257116eda93bfa668b88b60fb418a101d35fa0b125a18109d2cf4b72d207fb3187cbc9b13", 0xbfe0aa) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000400)={0x38, 0x5, 0x1, 0x0, 0x3, 0x1, 0x800000}, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snd/timer\x00', 0x0) clone(0x2200183, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$pfkey(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/self/net/pfkey\x00', 0x68800, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) pselect6(0x40, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x800000000000000}, 0x0, &(0x7f0000000300)={0x3ff}, 0x0, 0x0) [ 910.232600][T28948] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:25 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a5693800"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:25 executing program 0 (fault-call:12 fault-nth:25): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:25 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) r4 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="dd3f885f510505d641d51f4d43eb061441906b", 0x13, 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f0000000200)={0x0, r4}, &(0x7f0000000240)=""/207, 0xcf, &(0x7f0000000400)={&(0x7f0000000380)={'cbcmac-aes-neon\x00'}, &(0x7f00000003c0)="02bcfd0ad68cc826d9c7839618c8228d11c063586c38549b1e78a1e4eb93d4090e2ba028fc7e16c5705d0639bec8d0a4a48ce957d97861527b8fbdcbea93ff", 0x3f}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 910.391027][T28962] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 910.391988][T28965] FAULT_INJECTION: forcing a failure. [ 910.391988][T28965] name failslab, interval 1, probability 0, space 0, times 0 [ 910.410775][T28965] CPU: 1 PID: 28965 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 910.420908][T28965] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 910.430941][T28965] Call Trace: [ 910.434203][T28965] dump_stack+0x1b0/0x21e [ 910.438545][T28965] ? devkmsg_release+0x11c/0x11c [ 910.443452][T28965] ? show_regs_print_info+0x12/0x12 [ 910.448617][T28965] ? _raw_spin_lock+0xa1/0x170 [ 910.453352][T28965] ? _raw_spin_trylock_bh+0x190/0x190 [ 910.458696][T28965] ? netif_receive_skb_list_internal+0x46a/0x720 [ 910.465034][T28965] should_fail+0x6fb/0x860 [ 910.469425][T28965] ? setup_fault_attr+0x2b0/0x2b0 [ 910.474431][T28965] ? eth_get_headlen+0x240/0x240 [ 910.479349][T28965] ? iov_iter_advance+0x707/0xee0 [ 910.484347][T28965] ? __napi_alloc_skb+0xd6/0x520 [ 910.489372][T28965] should_failslab+0x5/0x20 [ 910.493844][T28965] kmem_cache_alloc+0x36/0x250 [ 910.498589][T28965] __napi_alloc_skb+0xd6/0x520 [ 910.503349][T28965] napi_get_frags+0x5c/0x100 [ 910.507915][T28965] tun_get_user+0x9ce/0x3400 [ 910.512496][T28965] ? tun_do_read+0x1f10/0x1f10 [ 910.517231][T28965] ? unwind_get_return_address_ptr+0x130/0x130 [ 910.523354][T28965] ? memset+0x1f/0x40 [ 910.527339][T28965] ? unwind_next_frame+0x1c07/0x22b0 [ 910.532595][T28965] ? __rcu_read_lock+0x50/0x50 [ 910.537334][T28965] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 910.543416][T28965] tun_chr_write_iter+0x121/0x1a0 [ 910.548427][T28965] __vfs_write+0x579/0x700 [ 910.552824][T28965] ? __kernel_write+0x340/0x340 [ 910.557651][T28965] ? __kernel_text_address+0x93/0x110 [ 910.563004][T28965] ? stack_trace_save+0x111/0x1e0 [ 910.568004][T28965] __kernel_write+0x12c/0x340 [ 910.572667][T28965] write_pipe_buf+0x148/0x1d0 [ 910.577340][T28965] ? default_file_splice_write+0x240/0x240 [ 910.583114][T28965] ? __rcu_read_lock+0x50/0x50 [ 910.587864][T28965] __splice_from_pipe+0x2d3/0x870 [ 910.592857][T28965] ? default_file_splice_write+0x240/0x240 [ 910.598634][T28965] default_file_splice_write+0x179/0x240 [ 910.604234][T28965] ? default_file_splice_read+0x920/0x920 [ 910.609920][T28965] ? avc_policy_seqno+0x17/0x70 [ 910.614741][T28965] ? security_file_permission+0x128/0x300 [ 910.620425][T28965] ? default_file_splice_read+0x920/0x920 [ 910.626112][T28965] __se_sys_splice+0x860/0x1b90 [ 910.630939][T28965] ? security_file_permission+0x128/0x300 [ 910.636624][T28965] ? fput_many+0x42/0x1a0 [ 910.640918][T28965] ? ksys_write+0x237/0x2a0 [ 910.645392][T28965] ? __x64_sys_splice+0xf0/0xf0 [ 910.650216][T28965] ? __x64_sys_splice+0x1d/0xf0 [ 910.655032][T28965] do_syscall_64+0xcb/0x150 [ 910.659506][T28965] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 910.665367][T28965] RIP: 0033:0x45d5b9 [ 910.669230][T28965] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 910.688889][T28965] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 910.697281][T28965] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 910.705223][T28965] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 910.713174][T28965] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 910.721120][T28965] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000019 [ 910.729062][T28965] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 910.862280][T28973] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xff000000}, 0x2}], 0x1, 0x2, 0x0) [ 910.982129][T28976] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 911.085295][T28983] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:25 executing program 0 (fault-call:12 fault-nth:26): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:26 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f00000000c0)=ANY=[@ANYRES32=r3], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r2, &(0x7f00000000c0)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:26 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:26 executing program 4: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000400)=ANY=[@ANYRESDEC=r0, @ANYRES64=r1], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000040)={0x24, 0x0, 0x0, &(0x7f0000000740)=ANY=[], 0x0}, 0x0) r3 = syz_open_dev$hidraw(&(0x7f00000005c0)='/dev/hidraw#\x00', 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/timer\x00', 0x0) ioctl$HIDIOCGRAWNAME(r3, 0x90044802, &(0x7f0000000080)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000180)={0x0, 0x0}) r5 = clone3(&(0x7f0000001600)={0x41088080, &(0x7f0000000100), &(0x7f0000000440), &(0x7f0000000480), {0x2e}, &(0x7f0000000600)=""/4096, 0x1000, &(0x7f00000004c0)=""/168, &(0x7f0000000580)=[0x0, 0xffffffffffffffff, 0x0, r4], 0x4}, 0x58) ioctl$TCSETXF(0xffffffffffffffff, 0x5434, &(0x7f0000000240)={0x1, 0x1, [0x3ff, 0x9, 0x5f8, 0x1, 0x7]}) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000001680)) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) clone3(&(0x7f00000016c0)={0x148030080, &(0x7f0000000000), &(0x7f0000000140), &(0x7f00000002c0)=0x0, {0x2}, &(0x7f0000001740)=""/236, 0xe6, &(0x7f0000000280)=""/18, &(0x7f0000000340)=[r5], 0x3fffffffffffffc3, {r7}}, 0x58) capget(&(0x7f0000000380)={0x20071026, r8}, &(0x7f00000003c0)={0x9, 0x4, 0x8863, 0x1, 0x10001, 0x4}) ioctl$KDGKBDIACR(r6, 0x4b4a, &(0x7f0000000200)=""/6) [ 911.248303][T28994] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 911.248554][T28999] FAULT_INJECTION: forcing a failure. [ 911.248554][T28999] name failslab, interval 1, probability 0, space 0, times 0 [ 911.268571][T28999] CPU: 0 PID: 28999 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 911.278798][T28999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 911.288837][T28999] Call Trace: [ 911.292103][T28999] dump_stack+0x1b0/0x21e [ 911.296501][T28999] ? devkmsg_release+0x11c/0x11c [ 911.301415][T28999] ? show_regs_print_info+0x12/0x12 [ 911.306600][T28999] ? __rcu_read_lock+0x50/0x50 [ 911.311345][T28999] ? _raw_spin_lock+0xa1/0x170 [ 911.316082][T28999] ? _raw_spin_trylock_bh+0x190/0x190 [ 911.321421][T28999] ? _raw_spin_lock+0xa1/0x170 [ 911.326169][T28999] should_fail+0x6fb/0x860 [ 911.330555][T28999] ? setup_fault_attr+0x2b0/0x2b0 [ 911.335559][T28999] ? setup_fault_attr+0x2b0/0x2b0 [ 911.340554][T28999] ? eth_get_headlen+0x240/0x240 [ 911.345462][T28999] ? tun_get_user+0xc08/0x3400 [ 911.350196][T28999] should_failslab+0x5/0x20 [ 911.354670][T28999] __kmalloc_track_caller+0x5d/0x2b0 [ 911.359937][T28999] ? __napi_alloc_skb+0xd6/0x520 [ 911.364843][T28999] ? tun_get_user+0xc08/0x3400 [ 911.369573][T28999] pskb_expand_head+0x10d/0xfb0 [ 911.374394][T28999] tun_get_user+0xc08/0x3400 [ 911.378971][T28999] ? tun_do_read+0x1f10/0x1f10 [ 911.383715][T28999] ? preempt_schedule_irq+0xc7/0x110 [ 911.388970][T28999] ? preempt_schedule_notrace+0x110/0x110 [ 911.394668][T28999] ? memset+0x1f/0x40 [ 911.398617][T28999] ? unwind_next_frame+0x1c07/0x22b0 [ 911.403868][T28999] ? __rcu_read_lock+0x50/0x50 [ 911.408599][T28999] ? iov_iter_init+0x83/0x160 [ 911.413244][T28999] tun_chr_write_iter+0x121/0x1a0 [ 911.418238][T28999] __vfs_write+0x579/0x700 [ 911.422623][T28999] ? __kernel_write+0x340/0x340 [ 911.427441][T28999] ? __kernel_text_address+0x93/0x110 [ 911.432801][T28999] ? stack_trace_save+0x111/0x1e0 [ 911.437792][T28999] __kernel_write+0x12c/0x340 [ 911.442435][T28999] write_pipe_buf+0x148/0x1d0 [ 911.447079][T28999] ? default_file_splice_write+0x240/0x240 [ 911.452862][T28999] ? __rcu_read_lock+0x50/0x50 [ 911.457596][T28999] __splice_from_pipe+0x2d3/0x870 [ 911.462589][T28999] ? default_file_splice_write+0x240/0x240 [ 911.468377][T28999] default_file_splice_write+0x179/0x240 [ 911.473991][T28999] ? default_file_splice_read+0x920/0x920 [ 911.479697][T28999] ? avc_policy_seqno+0x17/0x70 [ 911.484536][T28999] ? security_file_permission+0x128/0x300 [ 911.490222][T28999] ? default_file_splice_read+0x920/0x920 [ 911.495993][T28999] __se_sys_splice+0x860/0x1b90 [ 911.500814][T28999] ? security_file_permission+0x128/0x300 [ 911.506498][T28999] ? fput_many+0x42/0x1a0 [ 911.510807][T28999] ? ksys_write+0x237/0x2a0 [ 911.515276][T28999] ? __x64_sys_splice+0xf0/0xf0 [ 911.520111][T28999] ? __x64_sys_splice+0x1d/0xf0 [ 911.524928][T28999] do_syscall_64+0xcb/0x150 [ 911.529400][T28999] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 911.535265][T28999] RIP: 0033:0x45d5b9 [ 911.539131][T28999] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 911.558707][T28999] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 911.567095][T28999] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 911.575047][T28999] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 911.582995][T28999] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 911.590938][T28999] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001a [ 911.598894][T28999] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:26 executing program 3: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 911.712223][T29005] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 911.757159][ T4421] usb 5-1: new high-speed USB device number 56 using dummy_hcd 22:55:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x2000000000000}, 0x2}], 0x1, 0x2, 0x0) [ 911.823940][T29010] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:26 executing program 0 (fault-call:12 fault-nth:27): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 911.963146][T29016] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:26 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a569380064"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 912.037085][ T4421] usb 5-1: device descriptor read/64, error 18 22:55:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 912.082692][T29020] FAULT_INJECTION: forcing a failure. [ 912.082692][T29020] name failslab, interval 1, probability 0, space 0, times 0 [ 912.103637][T29020] CPU: 1 PID: 29020 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 912.113799][T29020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 912.123854][T29020] Call Trace: [ 912.127157][T29020] dump_stack+0x1b0/0x21e [ 912.131475][T29020] ? devkmsg_release+0x11c/0x11c [ 912.136399][T29020] ? show_regs_print_info+0x12/0x12 [ 912.141572][T29020] ? __rcu_read_lock+0x50/0x50 [ 912.146305][T29020] ? get_random_u32+0x112/0x210 [ 912.151123][T29020] ? kasan_init_slab_obj+0x20/0x30 [ 912.156258][T29020] should_fail+0x6fb/0x860 [ 912.160644][T29020] ? setup_fault_attr+0x2b0/0x2b0 [ 912.165653][T29020] ? setup_fault_attr+0x2b0/0x2b0 [ 912.170707][T29020] ? eth_get_headlen+0x240/0x240 [ 912.175680][T29020] ? tun_get_user+0xc08/0x3400 [ 912.180428][T29020] should_failslab+0x5/0x20 [ 912.184906][T29020] __kmalloc_track_caller+0x5d/0x2b0 [ 912.190163][T29020] ? __napi_alloc_skb+0xd6/0x520 [ 912.195074][T29020] ? tun_get_user+0xc08/0x3400 [ 912.199806][T29020] pskb_expand_head+0x10d/0xfb0 [ 912.204632][T29020] tun_get_user+0xc08/0x3400 [ 912.209194][T29020] ? tun_do_read+0x1f10/0x1f10 [ 912.213928][T29020] ? unwind_get_return_address_ptr+0x130/0x130 [ 912.220064][T29020] ? memset+0x1f/0x40 [ 912.224016][T29020] ? unwind_next_frame+0x1c07/0x22b0 [ 912.229271][T29020] ? __rcu_read_lock+0x50/0x50 [ 912.234002][T29020] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 912.240038][T29020] tun_chr_write_iter+0x121/0x1a0 [ 912.245033][T29020] __vfs_write+0x579/0x700 [ 912.249420][T29020] ? __kernel_write+0x340/0x340 [ 912.254238][T29020] ? __kernel_text_address+0x93/0x110 [ 912.259599][T29020] ? stack_trace_save+0x111/0x1e0 [ 912.264618][T29020] __kernel_write+0x12c/0x340 [ 912.269264][T29020] write_pipe_buf+0x148/0x1d0 [ 912.273910][T29020] ? default_file_splice_write+0x240/0x240 [ 912.279684][T29020] ? __rcu_read_lock+0x50/0x50 [ 912.284420][T29020] __splice_from_pipe+0x2d3/0x870 [ 912.289412][T29020] ? default_file_splice_write+0x240/0x240 [ 912.295202][T29020] default_file_splice_write+0x179/0x240 [ 912.300801][T29020] ? default_file_splice_read+0x920/0x920 [ 912.306487][T29020] ? avc_policy_seqno+0x17/0x70 [ 912.311321][T29020] ? security_file_permission+0x128/0x300 [ 912.317016][T29020] ? default_file_splice_read+0x920/0x920 [ 912.322713][T29020] __se_sys_splice+0x860/0x1b90 [ 912.327537][T29020] ? security_file_permission+0x128/0x300 [ 912.333230][T29020] ? fput_many+0x42/0x1a0 [ 912.337549][T29020] ? ksys_write+0x237/0x2a0 [ 912.342026][T29020] ? __x64_sys_splice+0xf0/0xf0 [ 912.346844][T29020] ? __x64_sys_splice+0x1d/0xf0 [ 912.351661][T29020] do_syscall_64+0xcb/0x150 [ 912.356147][T29020] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 912.362008][T29020] RIP: 0033:0x45d5b9 [ 912.365870][T29020] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 912.385441][T29020] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 912.393818][T29020] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 912.401758][T29020] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 912.409697][T29020] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 912.417637][T29020] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001b [ 912.425578][T29020] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 912.442841][T29028] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:27 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) ioctl$BTRFS_IOC_START_SYNC(r1, 0x80089418, &(0x7f00000000c0)) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000180)=ANY=[], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x7f}, 0x8) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x8001, 0x0) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000140)={0x0, 0x79, 0x5d}, &(0x7f0000000200)={'enc=', 'oaep', ' hash=', {'wp384\x00'}}, &(0x7f0000000280)="0340f63d06d1c291b6d7c97e872d25c6c6c2b8fb992b37a17b7f38da29e1c32e52c1cd25c2d430d767d4a3112d6c8e49a629841405b1a0970383e8fb4d7253498112863e3e49a0f36a216ab6c188888f5be8809a89f315a7bee146038971c098395959269880845e15a7fd6b79186225339eabb04573ea0d5c", &(0x7f0000000300)=""/93) [ 912.547610][T29030] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 912.669666][T29038] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 912.737032][ T4421] usb 5-1: device descriptor read/64, error 18 [ 913.007100][ T4421] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 913.277097][ T4421] usb 5-1: device descriptor read/64, error 18 [ 913.677008][ T4421] usb 5-1: device descriptor read/64, error 18 [ 913.797089][ T4421] usb usb5-port1: attempt power cycle 22:55:29 executing program 4: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) r4 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000140)={'syz', 0x3}, &(0x7f0000000180)="dd3f885f510505d641d51f4d43eb061441906b", 0x13, 0xfffffffffffffff8) keyctl$dh_compute(0x17, &(0x7f0000000200)={0x0, r4}, &(0x7f0000000240)=""/207, 0xcf, &(0x7f0000000400)={&(0x7f0000000380)={'cbcmac-aes-neon\x00'}, &(0x7f00000003c0)="02bcfd0ad68cc826d9c7839618c8228d11c063586c38549b1e78a1e4eb93d4090e2ba028fc7e16c5705d0639bec8d0a4a48ce957d97861527b8fbdcbea93ff", 0x3f}) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:29 executing program 0 (fault-call:12 fault-nth:28): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:29 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a569380064"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x20000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:29 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000180)={&(0x7f00000008c0)=ANY=[@ANYBLOB="00004000e5f24d52327af5857c26b5cd7dd7f5a8bc24d4c0d576a70e14fc4f7d8340d83b7c4cd491772e06c26c2073351b4347d0d50852769b5dea8d15bccebadf58bf26d6ef4b5ebc200000008d553266fbf7d8b6c7ffd2b5cdee758d4606362d77422bb3f3ff1d9b4b9a5a8c572fa35bb1b6724149ae56090000000c7352de861474f82a6457e35976949c87e256ee1f12c3812678da85156d15567c1de41c145b67b42e58b161a9f4388831e8c2e73ccc41267c10b511d225a5db7735f722f5678d1e194e9eedc1bf1ada75e8644f656deef232a61c2a8fb11c933d02d10a2f5325e43c4ae42763d820f065d4ea9d791dc6161507ff8d14663d8cc6c85edacef18fb1d612ba7b191bf89aad85e649ceb223cf16a0c266d3886b635f9877b0075ad6161552dae38700a3710b39baf2c59184e18722f1478c296b9ae5e110902ed8b5ae157f8b41d3a46321f51014101d31653e3d9af7bb768565c9352b14e6d262a371833c6b7917bb08f1abeac077c47db02fce665b9066196c683166fe8f54f86023bc487083df09cb35321b5e068d16367d98a3db5d8265e7ec70", @ANYRES16=0x0, @ANYBLOB="000327bd7000fcdbdf2500000000"], 0x14}}, 0x20000884) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f0000000380)={'filter\x00', 0x7, 0x4, 0x4e0, 0x2f0, 0x1e8, 0x2f0, 0x3f8, 0x3f8, 0x3f8, 0x4, &(0x7f0000000240), {[{{@arp={@dev={0xac, 0x14, 0x14, 0x2b}, @broadcast, 0x0, 0x7f, 0x0, 0xf, {@empty, {[0xff, 0xff, 0xff, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff, 0xff, 0xff]}}, 0x488, 0x2, 0x4, 0x8, 0x3, 0xca7b, 'ip6gretap0\x00', 'netpci0\x00', {}, {0xff}, 0x0, 0x5b}, 0xc0, 0x1e8}, @unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x1, 'system_u:object_r:var_spool_t:s0\x00'}}}, {{@uncond, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x0, 0x6, {0x7fe0000000}}}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, 0xffffffff, 0xffff00, 0x9, 0x4, {@mac=@dev={[], 0x17}, {[0xff, 0xff, 0x0, 0x0, 0xff]}}, {@empty, {[0xff, 0x7f, 0x0, 0x0, 0x0, 0xff]}}, 0x4, 0x3, 0x0, 0x51, 0x4, 0x1, 'veth1_to_bond\x00', 'hsr0\x00', {0xff}, {}, 0x0, 0x100}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00', 0x0, 0x2958, {0x3}}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x530) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$tun(r8, &(0x7f0000000e00)=ANY=[@ANYBLOB="02043f000400000808006790bdd403273201fe8000000000000000000000000000bbfe8800000000000000000000000000010802040108780000ff0100000000000000000000000000010c0c040605300008fe8000000000000000000000000000bbfe8000000000000000000000000000aa00000000000000000000000000000001fc020000000000000000000000000000fe8000000000000000000000000000aa000000000000000000000000000000003c04040200200100fe8000000000000000000000000000aafe8000000000000000000000000000bb88240000000000000502000320e3d8df58b3283a298983ea853cae1c20d9ec98ae811fa116d49f094e0a3cc7bc84941df39d49079057ff22625738f3402a0f2a81b6bc17f15a5f166165bbbd07acbb1b476b1a4b79d42a761d411a543c9d2919d1fccd6a2d8d2e92b3f26dfbfe94eb98616bfef6b238023c077ae27c93cfcb838934baa8d8c553324563ea7bf67fe516b43b6aead22726f997941a038de026ea31545041ac9a24ffe60b75511cc497bc624cb120f2fd7fbcc758bbe950e1bd991d1496e5fd1f77f5e3b55680e7da0b3142418db5c7a181cddd2d4a527ac76fd25dd87c282ee2d6f579f795afcf50bcc9d0c910fc020000000000000000000000000000c204000000280720000000000607ff00000000000000000005000000000000008100000000000000000000000016000099d780e5fae40d39678b6eda5dc6de81650000002b0600320000000020010000000000000000000000000001fc000000000000000000000000000000ff0200000000000000000000000000012f07000000000000c204000001610502ff7fc910ff010000000000000000000000000001c20400000007c910fe8000000000000000000000000000aa00010004010700000000000029e16c43a0aa8026b6d5ff0521433f8ec09ee5463b2a355b3084b1f066293468b6f35d8573023cb1e5810cd32cd0411b6e9c9b1a1513a8f6e2da99cc231dcd1c12de886e0bacad68e3c884dfe029d5b6852eb66a72439f54ffc95e6d4d7022d664221df4dd1d668705418b214d78e32b14ecce230e3f43b306c2bcf12fb930fd68fce2c4fb13d3f4774089745c9222b7f8c03082fbac7fcf040bd2825a51f21e02703176a8cc0e75b29f326ad98691f345dcb5b2cee8ed5183000cec36578a916aea6d5048a49a"], 0x359) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 914.268428][T29048] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 914.337347][T29054] FAULT_INJECTION: forcing a failure. [ 914.337347][T29054] name failslab, interval 1, probability 0, space 0, times 0 [ 914.349993][T29054] CPU: 0 PID: 29054 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 914.360119][T29054] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 914.370148][T29054] Call Trace: [ 914.373414][T29054] dump_stack+0x1b0/0x21e [ 914.377720][T29054] ? devkmsg_release+0x11c/0x11c [ 914.382635][T29054] ? show_regs_print_info+0x12/0x12 [ 914.388107][T29054] ? get_random_u32+0x112/0x210 [ 914.393102][T29054] ? kasan_init_slab_obj+0x20/0x30 [ 914.398274][T29054] ? new_slab+0x21c/0x450 [ 914.402574][T29054] should_fail+0x6fb/0x860 [ 914.406961][T29054] ? setup_fault_attr+0x2b0/0x2b0 [ 914.412016][T29054] ? eth_get_headlen+0x240/0x240 [ 914.416937][T29054] ? iov_iter_advance+0x707/0xee0 [ 914.421933][T29054] ? __napi_alloc_skb+0xd6/0x520 [ 914.426862][T29054] should_failslab+0x5/0x20 [ 914.431342][T29054] kmem_cache_alloc+0x36/0x250 [ 914.436091][T29054] __napi_alloc_skb+0xd6/0x520 [ 914.440834][T29054] napi_get_frags+0x5c/0x100 [ 914.445408][T29054] tun_get_user+0x9ce/0x3400 [ 914.449972][T29054] ? tun_do_read+0x1f10/0x1f10 [ 914.454704][T29054] ? unwind_get_return_address_ptr+0x130/0x130 [ 914.460834][T29054] ? memset+0x1f/0x40 [ 914.464789][T29054] ? unwind_next_frame+0x1c07/0x22b0 [ 914.470048][T29054] ? __rcu_read_lock+0x50/0x50 [ 914.474780][T29054] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 914.480825][T29054] tun_chr_write_iter+0x121/0x1a0 [ 914.485829][T29054] __vfs_write+0x579/0x700 [ 914.490215][T29054] ? __kernel_write+0x340/0x340 [ 914.495033][T29054] ? __kernel_text_address+0x93/0x110 [ 914.500378][T29054] ? stack_trace_save+0x111/0x1e0 [ 914.505371][T29054] __kernel_write+0x12c/0x340 [ 914.510063][T29054] write_pipe_buf+0x148/0x1d0 [ 914.514731][T29054] ? default_file_splice_write+0x240/0x240 [ 914.520506][T29054] ? __rcu_read_lock+0x50/0x50 [ 914.525237][T29054] __splice_from_pipe+0x2d3/0x870 [ 914.530238][T29054] ? default_file_splice_write+0x240/0x240 [ 914.536018][T29054] default_file_splice_write+0x179/0x240 [ 914.541618][T29054] ? default_file_splice_read+0x920/0x920 [ 914.547303][T29054] ? avc_policy_seqno+0x17/0x70 [ 914.552121][T29054] ? security_file_permission+0x128/0x300 [ 914.557858][T29054] ? default_file_splice_read+0x920/0x920 [ 914.563592][T29054] __se_sys_splice+0x860/0x1b90 [ 914.568411][T29054] ? security_file_permission+0x128/0x300 [ 914.574096][T29054] ? fput_many+0x42/0x1a0 [ 914.578396][T29054] ? ksys_write+0x237/0x2a0 [ 914.582863][T29054] ? __x64_sys_splice+0xf0/0xf0 [ 914.587679][T29054] ? __x64_sys_splice+0x1d/0xf0 [ 914.592497][T29054] do_syscall_64+0xcb/0x150 [ 914.596968][T29054] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 914.602826][T29054] RIP: 0033:0x45d5b9 [ 914.606685][T29054] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 914.626270][T29054] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.634645][T29054] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 914.642584][T29054] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 914.650526][T29054] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 914.658468][T29054] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001c [ 914.666427][T29054] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.694750][T29061] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.740250][T29065] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.789660][T29067] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.841635][T29071] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 914.899737][T29073] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 914.960192][T29076] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x40000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:30 executing program 4: socket$netlink(0x10, 0x3, 0x0) r0 = getpid() r1 = getpid() rt_tgsigqueueinfo(r0, r1, 0x16, &(0x7f0000000000)) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3") ptrace$getregset(0x4205, r0, 0x200, &(0x7f00000005c0)={&(0x7f0000001600)=""/4096, 0x1000}) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r0, 0x10, &(0x7f0000000080)) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000000000)=0xc) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={&(0x7f0000000140)="6d260bd236616edb3b8032bc87d23c811b70882a2e1c18afb18c2fe8d2f860743ed48de440ab878cea5e76be946aa807c2888c0df04495aea3733ac54071fdb2452a01b0786b296fe1ffafc1ed18eff70a40a3c310f18a7d0ea78120cd5cb6207e1f871033e2ed0b3c7349e0a6b170d11e8f99", &(0x7f00000001c0)=""/195, &(0x7f00000002c0)="2bf25305393b354182ffa5fc3ebb38df9fde5e2e680ff4f9930cc6c37dc6c85c175a4e66bb0c052fcdc9aabe1caa00fce52a38544f70d9dd31aec196d3a2cb4f5b382cab2bd7fbabedbe7786a0fa7d7af8902682f82f32319cd19af7136063b7993537476d7d5dd12c4002ea0d34d924a87097398104b701c4f8ee1f8ca634f71207a396c53d8be27fc6e567cc5d3f4dfd4267abf61d0e54117dbe42c3a87e06aa88d05e9c2924874e06482acb231bd4e0e6", &(0x7f0000000380)="6c66a8be9d44489091c80ff72abedb3ac1b5cf", 0x80000001, r5, 0x4}, 0x38) setregid(r4, 0xffffffffffffffff) setregid(0x0, 0xffffffffffffffff) lchown(&(0x7f0000000040)='./file0\x00', r3, r4) 22:55:30 executing program 0 (fault-call:12 fault-nth:29): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:30 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a569380064"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:30 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r7, 0x407, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f00000000c0)={0x33, @loopback, 0x4e20, 0x4, 'wlc\x00', 0x1, 0xb9, 0x4f}, 0x2c) ioctl$sock_ifreq(r0, 0x8971, &(0x7f0000000140)={'vlan1\x00', @ifru_hwaddr=@random="2d57c796fcba"}) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 915.188599][T29086] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 915.254274][T29094] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 915.298487][T29098] FAULT_INJECTION: forcing a failure. [ 915.298487][T29098] name failslab, interval 1, probability 0, space 0, times 0 [ 915.315897][T29098] CPU: 1 PID: 29098 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 915.326073][T29098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 915.336104][T29098] Call Trace: [ 915.339372][T29098] dump_stack+0x1b0/0x21e [ 915.343670][T29098] ? devkmsg_release+0x11c/0x11c [ 915.348572][T29098] ? show_regs_print_info+0x12/0x12 [ 915.353737][T29098] ? __rcu_read_lock+0x50/0x50 [ 915.358467][T29098] ? _raw_spin_lock+0xa1/0x170 [ 915.363201][T29098] should_fail+0x6fb/0x860 [ 915.367585][T29098] ? setup_fault_attr+0x2b0/0x2b0 [ 915.372574][T29098] ? setup_fault_attr+0x2b0/0x2b0 [ 915.377568][T29098] ? eth_get_headlen+0x240/0x240 [ 915.382471][T29098] ? tun_get_user+0xc08/0x3400 [ 915.387202][T29098] should_failslab+0x5/0x20 [ 915.391672][T29098] __kmalloc_track_caller+0x5d/0x2b0 [ 915.396936][T29098] ? __napi_alloc_skb+0xd6/0x520 [ 915.401839][T29098] ? tun_get_user+0xc08/0x3400 [ 915.406568][T29098] pskb_expand_head+0x10d/0xfb0 [ 915.411388][T29098] tun_get_user+0xc08/0x3400 [ 915.415946][T29098] ? tun_do_read+0x1f10/0x1f10 [ 915.420678][T29098] ? unwind_get_return_address_ptr+0x130/0x130 [ 915.426805][T29098] ? memset+0x1f/0x40 [ 915.430754][T29098] ? unwind_next_frame+0x1c07/0x22b0 [ 915.436016][T29098] ? __rcu_read_lock+0x50/0x50 [ 915.440748][T29098] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 915.446780][T29098] tun_chr_write_iter+0x121/0x1a0 [ 915.451772][T29098] __vfs_write+0x579/0x700 [ 915.456156][T29098] ? __kernel_write+0x340/0x340 [ 915.460972][T29098] ? __kernel_text_address+0x93/0x110 [ 915.466332][T29098] ? stack_trace_save+0x111/0x1e0 [ 915.471333][T29098] __kernel_write+0x12c/0x340 [ 915.475983][T29098] write_pipe_buf+0x148/0x1d0 [ 915.480634][T29098] ? default_file_splice_write+0x240/0x240 [ 915.486415][T29098] ? __rcu_read_lock+0x50/0x50 [ 915.491149][T29098] __splice_from_pipe+0x2d3/0x870 [ 915.496141][T29098] ? default_file_splice_write+0x240/0x240 [ 915.501916][T29098] default_file_splice_write+0x179/0x240 [ 915.507518][T29098] ? default_file_splice_read+0x920/0x920 [ 915.513203][T29098] ? avc_policy_seqno+0x17/0x70 [ 915.518024][T29098] ? security_file_permission+0x128/0x300 [ 915.523708][T29098] ? default_file_splice_read+0x920/0x920 [ 915.529397][T29098] __se_sys_splice+0x860/0x1b90 [ 915.534220][T29098] ? security_file_permission+0x128/0x300 [ 915.539906][T29098] ? fput_many+0x42/0x1a0 [ 915.544205][T29098] ? ksys_write+0x237/0x2a0 [ 915.548673][T29098] ? __x64_sys_splice+0xf0/0xf0 [ 915.553491][T29098] ? __x64_sys_splice+0x1d/0xf0 [ 915.558308][T29098] do_syscall_64+0xcb/0x150 [ 915.562779][T29098] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 915.568641][T29098] RIP: 0033:0x45d5b9 [ 915.572505][T29098] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 915.592089][T29098] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 915.600473][T29098] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 915.608416][T29098] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 915.616356][T29098] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 915.624299][T29098] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001d [ 915.632238][T29098] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 915.642257][T29103] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 915.719085][T29105] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(0xffffffffffffffff, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 915.831816][T29108] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x100000000000000}, 0x2}], 0x1, 0x2, 0x0) [ 915.931459][T29111] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:30 executing program 4: r0 = syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x47f, 0xffffffff, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x6, 0xe3, 0xfc}}]}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2cff7f6f75705f6964fb485499ca8e26a849a0a53d507376bdae0302e8e8cd2144429816800b6eb3f356fd545353fd3d45485f2cdb8670f7f36f7276f3724f6c", @ANYRESDEC=0x0]) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r8, 0x407, 0x0) r9 = syz_usb_connect$hid(0x4, 0x36, &(0x7f0000000340)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYRES64=r3, @ANYRESDEC=r8, @ANYRESHEX=r0, @ANYRESDEC=r2, @ANYRES32, @ANYRESDEC=r5, @ANYBLOB="9342953654e9be70e70d25d063c4531c245877243b3edfa2fd134da84ce83fc7d8e7f3f99e1c07787b8685371a993b9c157d0cb75525bdca25922a7c3590993f61f9b7c7979e26e23b8c929594bb02cec31165d0e2a89e3cff3d6df376bda4388ce4275942b6bf8771569772b3861c93975d6b2daa985d70075573303306da36013636884b8b0ecb03205246483c6f157d686fabbfb766a091e16f328ec7e5805a16782605819cf04d62a0ec9d4921c5d1f2e0f50d976412f914904c6b5cd89828bc0af2c98c1b92e269d024674dedeca07c7f596d04865f2ec92f", @ANYRESOCT], 0x0) syz_usb_control_io(r9, 0x0, 0x0) syz_usb_control_io$hid(r9, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000540)={0x0, 0x22, 0x5, {[@main=@item_012={0x1, 0x0, 0xa, '\"'}, @global=@item_012={0x2, 0x1, 0x2, "0001"}]}}, 0x0}, 0x0) 22:55:30 executing program 0 (fault-call:12 fault-nth:30): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:30 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:30 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaa7109362390b15d57d3ed9289aa70ed1e57a848834163a9789e01954fc96c179e3e0b9144d8009a0865cdd74f1f76131200"/73], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendmsg$nl_route(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=@newlinkprop={0x70, 0x6c, 0x8, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x20002, 0x1}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x4}, @IFLA_EVENT={0x8, 0x2c, 0x8}, @IFLA_BROADCAST={0xa}, @IFLA_EVENT={0x8, 0x2c, 0xffff}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x2}, @IFLA_PHYS_SWITCH_ID={0x11, 0x24, "b26b51d4aca9c3e96cee9842cc"}, @IFLA_CARRIER={0x5, 0x21, 0x1a}, @IFLA_TARGET_NETNSID={0x8, 0x2e, 0x4}]}, 0x70}, 0x1, 0x0, 0x0, 0x4004850}, 0x1) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 916.081135][T29124] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 916.124449][T29130] FAULT_INJECTION: forcing a failure. [ 916.124449][T29130] name failslab, interval 1, probability 0, space 0, times 0 [ 916.137102][T29130] CPU: 1 PID: 29130 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 916.147238][T29130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 916.157274][T29130] Call Trace: [ 916.160533][T29130] dump_stack+0x1b0/0x21e [ 916.164838][T29130] ? devkmsg_release+0x11c/0x11c [ 916.169747][T29130] ? show_regs_print_info+0x12/0x12 [ 916.174915][T29130] ? get_random_u32+0x112/0x210 [ 916.179770][T29130] ? kasan_init_slab_obj+0x20/0x30 [ 916.184889][T29130] ? new_slab+0x21c/0x450 [ 916.189258][T29130] should_fail+0x6fb/0x860 [ 916.193642][T29130] ? setup_fault_attr+0x2b0/0x2b0 [ 916.198634][T29130] ? eth_get_headlen+0x240/0x240 [ 916.203540][T29130] ? iov_iter_advance+0x707/0xee0 [ 916.208532][T29130] ? __napi_alloc_skb+0xd6/0x520 [ 916.213441][T29130] should_failslab+0x5/0x20 [ 916.217915][T29130] kmem_cache_alloc+0x36/0x250 [ 916.222650][T29130] __napi_alloc_skb+0xd6/0x520 [ 916.227383][T29130] napi_get_frags+0x5c/0x100 [ 916.231941][T29130] tun_get_user+0x9ce/0x3400 [ 916.236502][T29130] ? tun_do_read+0x1f10/0x1f10 [ 916.241292][T29130] ? unwind_get_return_address_ptr+0x130/0x130 [ 916.247414][T29130] ? memset+0x1f/0x40 [ 916.251416][T29130] ? unwind_next_frame+0x1c07/0x22b0 [ 916.256677][T29130] ? __rcu_read_lock+0x50/0x50 [ 916.261418][T29130] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 916.267458][T29130] tun_chr_write_iter+0x121/0x1a0 [ 916.272467][T29130] __vfs_write+0x579/0x700 [ 916.276854][T29130] ? __kernel_write+0x340/0x340 [ 916.281670][T29130] ? __kernel_text_address+0x93/0x110 [ 916.287012][T29130] ? stack_trace_save+0x111/0x1e0 [ 916.292002][T29130] __kernel_write+0x12c/0x340 [ 916.296646][T29130] write_pipe_buf+0x148/0x1d0 [ 916.296847][ T4421] usb 5-1: new low-speed USB device number 59 using dummy_hcd [ 916.301298][T29130] ? default_file_splice_write+0x240/0x240 [ 916.301309][T29130] ? __rcu_read_lock+0x50/0x50 [ 916.301316][T29130] __splice_from_pipe+0x2d3/0x870 [ 916.301328][T29130] ? default_file_splice_write+0x240/0x240 [ 916.330044][T29130] default_file_splice_write+0x179/0x240 [ 916.335645][T29130] ? default_file_splice_read+0x920/0x920 [ 916.341330][T29130] ? avc_policy_seqno+0x17/0x70 [ 916.346161][T29130] ? security_file_permission+0x128/0x300 [ 916.351857][T29130] ? default_file_splice_read+0x920/0x920 [ 916.357541][T29130] __se_sys_splice+0x860/0x1b90 [ 916.362361][T29130] ? security_file_permission+0x128/0x300 [ 916.368057][T29130] ? fput_many+0x42/0x1a0 [ 916.372370][T29130] ? ksys_write+0x237/0x2a0 [ 916.376854][T29130] ? __x64_sys_splice+0xf0/0xf0 [ 916.381678][T29130] ? __x64_sys_splice+0x1d/0xf0 [ 916.386499][T29130] do_syscall_64+0xcb/0x150 [ 916.390975][T29130] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 916.396842][T29130] RIP: 0033:0x45d5b9 [ 916.400704][T29130] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:55:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 916.420276][T29130] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 916.428678][T29130] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 916.436619][T29130] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 916.444562][T29130] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 916.452516][T29130] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e [ 916.460471][T29130] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 916.511827][T29134] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 916.546851][ T4421] usb 5-1: Invalid ep0 maxpacket: 32 22:55:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 916.650779][T29137] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 916.696841][ T4421] usb 5-1: new low-speed USB device number 60 using dummy_hcd 22:55:31 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x200000000000000}, 0x2}], 0x1, 0x2, 0x0) [ 916.751575][T29141] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:31 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:31 executing program 0 (fault-call:12 fault-nth:31): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 916.856142][T29146] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:31 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 916.936831][ T4421] usb 5-1: Invalid ep0 maxpacket: 32 [ 916.942240][ T4421] usb usb5-port1: attempt power cycle [ 916.963062][T29154] FAULT_INJECTION: forcing a failure. [ 916.963062][T29154] name failslab, interval 1, probability 0, space 0, times 0 [ 916.975798][T29154] CPU: 0 PID: 29154 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 916.985933][T29154] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 916.995971][T29154] Call Trace: [ 916.999235][T29154] dump_stack+0x1b0/0x21e [ 917.003572][T29154] ? devkmsg_release+0x11c/0x11c [ 917.008477][T29154] ? show_regs_print_info+0x12/0x12 [ 917.013644][T29154] ? __rcu_read_lock+0x50/0x50 [ 917.018385][T29154] ? _raw_spin_lock+0xa1/0x170 [ 917.023127][T29154] ? _raw_spin_trylock_bh+0x190/0x190 [ 917.028464][T29154] ? _raw_spin_lock+0xa1/0x170 [ 917.033198][T29154] should_fail+0x6fb/0x860 [ 917.037594][T29154] ? setup_fault_attr+0x2b0/0x2b0 [ 917.042585][T29154] ? setup_fault_attr+0x2b0/0x2b0 [ 917.047576][T29154] ? eth_get_headlen+0x240/0x240 [ 917.052480][T29154] ? tun_get_user+0xc08/0x3400 [ 917.057212][T29154] should_failslab+0x5/0x20 [ 917.061684][T29154] __kmalloc_track_caller+0x5d/0x2b0 [ 917.066937][T29154] ? __napi_alloc_skb+0xd6/0x520 [ 917.071870][T29154] ? tun_get_user+0xc08/0x3400 [ 917.077225][T29154] pskb_expand_head+0x10d/0xfb0 [ 917.082083][T29154] tun_get_user+0xc08/0x3400 [ 917.086643][T29154] ? tun_do_read+0x1f10/0x1f10 [ 917.091419][T29154] ? unwind_get_return_address_ptr+0x130/0x130 [ 917.097541][T29154] ? memset+0x1f/0x40 [ 917.101495][T29154] ? unwind_next_frame+0x1c07/0x22b0 [ 917.106749][T29154] ? __rcu_read_lock+0x50/0x50 [ 917.111504][T29154] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 917.117537][T29154] tun_chr_write_iter+0x121/0x1a0 [ 917.122530][T29154] __vfs_write+0x579/0x700 [ 917.126912][T29154] ? __kernel_write+0x340/0x340 [ 917.131732][T29154] ? __kernel_text_address+0x93/0x110 [ 917.137071][T29154] ? stack_trace_save+0x111/0x1e0 [ 917.142060][T29154] __kernel_write+0x12c/0x340 [ 917.146704][T29154] write_pipe_buf+0x148/0x1d0 [ 917.151347][T29154] ? default_file_splice_write+0x240/0x240 [ 917.157120][T29154] ? __rcu_read_lock+0x50/0x50 [ 917.161870][T29154] __splice_from_pipe+0x2d3/0x870 [ 917.166862][T29154] ? default_file_splice_write+0x240/0x240 [ 917.172634][T29154] default_file_splice_write+0x179/0x240 [ 917.178234][T29154] ? default_file_splice_read+0x920/0x920 [ 917.183917][T29154] ? avc_policy_seqno+0x17/0x70 [ 917.188736][T29154] ? security_file_permission+0x128/0x300 [ 917.194440][T29154] ? default_file_splice_read+0x920/0x920 [ 917.200140][T29154] __se_sys_splice+0x860/0x1b90 [ 917.204959][T29154] ? security_file_permission+0x128/0x300 [ 917.210651][T29154] ? fput_many+0x42/0x1a0 [ 917.214946][T29154] ? ksys_write+0x237/0x2a0 [ 917.219414][T29154] ? __x64_sys_splice+0xf0/0xf0 [ 917.224255][T29154] ? __x64_sys_splice+0x1d/0xf0 [ 917.229072][T29154] do_syscall_64+0xcb/0x150 [ 917.233543][T29154] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 917.239409][T29154] RIP: 0033:0x45d5b9 [ 917.243273][T29154] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 917.262843][T29154] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 917.271244][T29154] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 917.279186][T29154] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 917.287128][T29154] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 917.295083][T29154] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001f [ 917.303030][T29154] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 917.826779][ T4421] usb 5-1: new low-speed USB device number 61 using dummy_hcd [ 917.926845][ T4421] usb 5-1: Invalid ep0 maxpacket: 32 [ 918.076800][ T4421] usb 5-1: new low-speed USB device number 62 using dummy_hcd [ 918.166807][ T4421] usb 5-1: Invalid ep0 maxpacket: 32 [ 918.172202][ T4421] usb usb5-port1: unable to enumerate USB device 22:55:33 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000480)={0x8b, 0x0, 0x6, 0x0, 0x5, 0x3, 0x1, 0x7ff}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) recvmmsg(r1, &(0x7f0000000680)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=""/246, 0xf6}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x4) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x2, 0x0, 0x45122343, 0x3, 0x0, 0x944}, 0x0) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r4, &(0x7f0000000980), 0x10a9) syz_open_procfs(0x0, 0x0) r5 = creat(&(0x7f0000000140)='./bus\x00', 0xa) fcntl$setstatus(r5, 0x4, 0x46000) lseek(r5, 0x4200, 0x0) r6 = creat(&(0x7f0000000000)='./bus\x00', 0x9) io_setup(0x1ff, &(0x7f00000004c0)=0x0) r8 = open(&(0x7f0000000180)='./bus\x00', 0x143042, 0x1) ioctl$FS_IOC_RESVSP(r8, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000001}) io_submit(r7, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r6, &(0x7f0000000000), 0x10000}]) r9 = open(&(0x7f0000000080)='./bus\x00', 0x0, 0x4a) sendfile(r5, r9, 0x0, 0x8400fffffffb) sendfile(r4, r4, &(0x7f0000000100), 0x8080ffffff7e) 22:55:33 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:33 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) r5 = openat(r1, &(0x7f00000000c0)='./file0\x00', 0x90801, 0x34) getsockopt$inet6_int(r5, 0x29, 0x13, &(0x7f0000000140), &(0x7f0000000180)=0x4) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:33 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x300000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:33 executing program 0 (fault-call:12 fault-nth:32): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:33 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 919.089296][T29166] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 919.158195][T29174] FAULT_INJECTION: forcing a failure. [ 919.158195][T29174] name failslab, interval 1, probability 0, space 0, times 0 [ 919.171072][T29174] CPU: 1 PID: 29174 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 919.181224][T29174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 919.191253][T29174] Call Trace: [ 919.194514][T29174] dump_stack+0x1b0/0x21e [ 919.198819][T29174] ? devkmsg_release+0x11c/0x11c [ 919.203725][T29174] ? show_regs_print_info+0x12/0x12 [ 919.208894][T29174] ? __rcu_read_lock+0x50/0x50 [ 919.213633][T29174] ? get_random_u32+0x112/0x210 [ 919.218457][T29174] ? kasan_init_slab_obj+0x20/0x30 [ 919.223548][T29174] should_fail+0x6fb/0x860 [ 919.227940][T29174] ? setup_fault_attr+0x2b0/0x2b0 [ 919.232932][T29174] ? setup_fault_attr+0x2b0/0x2b0 [ 919.237927][T29174] ? eth_get_headlen+0x240/0x240 [ 919.242837][T29174] ? tun_get_user+0xc08/0x3400 [ 919.247574][T29174] should_failslab+0x5/0x20 [ 919.252049][T29174] __kmalloc_track_caller+0x5d/0x2b0 [ 919.257300][T29174] ? __napi_alloc_skb+0xd6/0x520 [ 919.262204][T29174] ? tun_get_user+0xc08/0x3400 [ 919.266934][T29174] pskb_expand_head+0x10d/0xfb0 [ 919.271758][T29174] tun_get_user+0xc08/0x3400 [ 919.276319][T29174] ? tun_do_read+0x1f10/0x1f10 [ 919.281056][T29174] ? unwind_get_return_address_ptr+0x130/0x130 [ 919.287179][T29174] ? memset+0x1f/0x40 [ 919.291135][T29174] ? unwind_next_frame+0x1c07/0x22b0 [ 919.296399][T29174] ? __rcu_read_lock+0x50/0x50 [ 919.301133][T29174] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 919.307181][T29174] tun_chr_write_iter+0x121/0x1a0 [ 919.312175][T29174] __vfs_write+0x579/0x700 [ 919.316565][T29174] ? __kernel_write+0x340/0x340 [ 919.321405][T29174] ? __kernel_text_address+0x93/0x110 [ 919.326767][T29174] ? __kernel_write+0xe8/0x340 [ 919.331497][T29174] __kernel_write+0x12c/0x340 [ 919.336144][T29174] write_pipe_buf+0x148/0x1d0 [ 919.340789][T29174] ? default_file_splice_write+0x240/0x240 [ 919.346562][T29174] ? __rcu_read_lock+0x50/0x50 [ 919.351293][T29174] __splice_from_pipe+0x2d3/0x870 [ 919.356287][T29174] ? default_file_splice_write+0x240/0x240 [ 919.362058][T29174] default_file_splice_write+0x179/0x240 [ 919.367660][T29174] ? default_file_splice_read+0x920/0x920 [ 919.373346][T29174] ? avc_policy_seqno+0x17/0x70 [ 919.378174][T29174] ? security_file_permission+0x128/0x300 [ 919.383860][T29174] ? default_file_splice_read+0x920/0x920 [ 919.389829][T29174] __se_sys_splice+0x860/0x1b90 [ 919.394666][T29174] ? security_file_permission+0x128/0x300 [ 919.400354][T29174] ? fput_many+0x42/0x1a0 [ 919.404648][T29174] ? ksys_write+0x237/0x2a0 [ 919.409122][T29174] ? __x64_sys_splice+0xf0/0xf0 [ 919.413942][T29174] ? __x64_sys_splice+0x1d/0xf0 [ 919.418759][T29174] do_syscall_64+0xcb/0x150 [ 919.423231][T29174] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 919.429121][T29174] RIP: 0033:0x45d5b9 [ 919.432984][T29174] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 919.452555][T29174] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 919.460937][T29174] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 919.468877][T29174] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 919.476822][T29174] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 919.484803][T29174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000020 [ 919.492747][T29174] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 919.569136][T29179] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 919.657686][T29182] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 919.794444][T29185] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x400000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:34 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0xf3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$describe(0x6, r0, &(0x7f0000000140)=""/147, 0x93) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKROGET(r1, 0x125e, &(0x7f0000000080)) 22:55:34 executing program 0 (fault-call:12 fault-nth:33): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:34 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/bsg\x00', 0x2000, 0x0) ioctl$NS_GET_OWNER_UID(r4, 0xb704, &(0x7f0000000140)) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r4, 0x0, r1, 0x0, 0x18100, 0x0) [ 919.906538][T29192] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:34 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 920.049688][T29205] FAULT_INJECTION: forcing a failure. [ 920.049688][T29205] name failslab, interval 1, probability 0, space 0, times 0 [ 920.049698][T29207] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 920.062333][T29205] CPU: 1 PID: 29205 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 920.062338][T29205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 920.062340][T29205] Call Trace: [ 920.062353][T29205] dump_stack+0x1b0/0x21e [ 920.062363][T29205] ? devkmsg_release+0x11c/0x11c [ 920.062370][T29205] ? show_regs_print_info+0x12/0x12 [ 920.062380][T29205] ? get_random_u32+0x112/0x210 [ 920.062386][T29205] ? kasan_init_slab_obj+0x20/0x30 [ 920.062394][T29205] ? new_slab+0x21c/0x450 [ 920.062401][T29205] should_fail+0x6fb/0x860 [ 920.062409][T29205] ? setup_fault_attr+0x2b0/0x2b0 [ 920.062418][T29205] ? eth_get_headlen+0x240/0x240 [ 920.062425][T29205] ? iov_iter_advance+0x707/0xee0 [ 920.062437][T29205] ? __napi_alloc_skb+0xd6/0x520 [ 920.145758][T29205] should_failslab+0x5/0x20 [ 920.150231][T29205] kmem_cache_alloc+0x36/0x250 [ 920.154969][T29205] __napi_alloc_skb+0xd6/0x520 [ 920.159706][T29205] napi_get_frags+0x5c/0x100 [ 920.164272][T29205] tun_get_user+0x9ce/0x3400 [ 920.168831][T29205] ? tun_do_read+0x1f10/0x1f10 [ 920.173590][T29205] ? unwind_get_return_address_ptr+0x130/0x130 [ 920.179712][T29205] ? memset+0x1f/0x40 [ 920.183663][T29205] ? unwind_next_frame+0x1c07/0x22b0 [ 920.188918][T29205] ? __rcu_read_lock+0x50/0x50 [ 920.193650][T29205] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 920.199684][T29205] tun_chr_write_iter+0x121/0x1a0 [ 920.204678][T29205] __vfs_write+0x579/0x700 [ 920.209065][T29205] ? __kernel_write+0x340/0x340 [ 920.213884][T29205] ? __kernel_text_address+0x93/0x110 [ 920.219241][T29205] ? stack_trace_save+0x111/0x1e0 [ 920.224235][T29205] __kernel_write+0x12c/0x340 [ 920.228906][T29205] write_pipe_buf+0x148/0x1d0 [ 920.233550][T29205] ? default_file_splice_write+0x240/0x240 [ 920.239339][T29205] ? __rcu_read_lock+0x50/0x50 [ 920.244081][T29205] __splice_from_pipe+0x2d3/0x870 [ 920.249073][T29205] ? default_file_splice_write+0x240/0x240 [ 920.254848][T29205] default_file_splice_write+0x179/0x240 [ 920.260464][T29205] ? default_file_splice_read+0x920/0x920 [ 920.266150][T29205] ? avc_policy_seqno+0x17/0x70 [ 920.270986][T29205] ? security_file_permission+0x128/0x300 [ 920.276671][T29205] ? default_file_splice_read+0x920/0x920 [ 920.282359][T29205] __se_sys_splice+0x860/0x1b90 [ 920.287178][T29205] ? security_file_permission+0x128/0x300 [ 920.292864][T29205] ? fput_many+0x42/0x1a0 [ 920.297162][T29205] ? ksys_write+0x237/0x2a0 [ 920.301654][T29205] ? __x64_sys_splice+0xf0/0xf0 [ 920.306477][T29205] ? __x64_sys_splice+0x1d/0xf0 [ 920.311303][T29205] do_syscall_64+0xcb/0x150 [ 920.315774][T29205] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 920.321632][T29205] RIP: 0033:0x45d5b9 [ 920.325511][T29205] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 920.345098][T29205] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 920.353476][T29205] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 920.361422][T29205] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 920.369371][T29205] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 920.377311][T29205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000021 [ 920.385278][T29205] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 920.492091][T29210] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 920.589612][T29213] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x800000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:35 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 920.716334][T29219] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:35 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) sendmsg$NFT_MSG_GETTABLE(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x4c, 0x1, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x6}, [@NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TABLE_FLAGS={0x8}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40044}, 0x4000000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) r7 = socket(0x11, 0x800000003, 0x0) bind(r7, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r7, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0x51d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x8}}}, 0x24}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vxcan0\x00', r8}) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:35 executing program 0 (fault-call:12 fault-nth:34): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 920.839187][T29227] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:35 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x400000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:35 executing program 4: pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, &(0x7f0000000040)={0x7ff}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="0010eeffffffffff040000c3400000f10080"], 0x1}}, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000005e00", 0x6) write$binfmt_misc(r1, &(0x7f0000000180)=ANY=[], 0xfffffc7b) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 22:55:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 920.948860][T29237] FAULT_INJECTION: forcing a failure. [ 920.948860][T29237] name failslab, interval 1, probability 0, space 0, times 0 [ 920.961748][T29237] CPU: 0 PID: 29237 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 920.971889][T29237] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 920.981936][T29237] Call Trace: [ 920.985215][T29237] dump_stack+0x1b0/0x21e [ 920.989528][T29237] ? devkmsg_release+0x11c/0x11c [ 920.994437][T29237] ? show_regs_print_info+0x12/0x12 [ 920.999612][T29237] ? __rcu_read_lock+0x50/0x50 [ 921.004400][T29237] ? get_random_u32+0x112/0x210 [ 921.009219][T29237] ? kasan_init_slab_obj+0x20/0x30 [ 921.014298][T29237] should_fail+0x6fb/0x860 [ 921.018689][T29237] ? setup_fault_attr+0x2b0/0x2b0 [ 921.023684][T29237] ? setup_fault_attr+0x2b0/0x2b0 [ 921.028677][T29237] ? eth_get_headlen+0x240/0x240 [ 921.033631][T29237] ? tun_get_user+0xc08/0x3400 [ 921.038374][T29237] should_failslab+0x5/0x20 [ 921.042849][T29237] __kmalloc_track_caller+0x5d/0x2b0 [ 921.048113][T29237] ? __napi_alloc_skb+0xd6/0x520 [ 921.053018][T29237] ? tun_get_user+0xc08/0x3400 [ 921.057745][T29237] pskb_expand_head+0x10d/0xfb0 [ 921.062568][T29237] tun_get_user+0xc08/0x3400 [ 921.067130][T29237] ? tun_do_read+0x1f10/0x1f10 [ 921.071943][T29237] ? unwind_get_return_address_ptr+0x130/0x130 [ 921.078067][T29237] ? memset+0x1f/0x40 [ 921.082017][T29237] ? unwind_next_frame+0x1c07/0x22b0 [ 921.087268][T29237] ? __rcu_read_lock+0x50/0x50 [ 921.092019][T29237] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 921.098052][T29237] tun_chr_write_iter+0x121/0x1a0 [ 921.103045][T29237] __vfs_write+0x579/0x700 [ 921.107428][T29237] ? __kernel_write+0x340/0x340 [ 921.112250][T29237] ? __kernel_text_address+0x93/0x110 [ 921.117600][T29237] ? stack_trace_save+0x111/0x1e0 [ 921.122593][T29237] __kernel_write+0x12c/0x340 [ 921.127244][T29237] write_pipe_buf+0x148/0x1d0 [ 921.131897][T29237] ? default_file_splice_write+0x240/0x240 [ 921.137671][T29237] ? __rcu_read_lock+0x50/0x50 [ 921.142400][T29237] __splice_from_pipe+0x2d3/0x870 [ 921.147427][T29237] ? default_file_splice_write+0x240/0x240 [ 921.153198][T29237] default_file_splice_write+0x179/0x240 [ 921.158844][T29237] ? default_file_splice_read+0x920/0x920 [ 921.164535][T29237] ? avc_policy_seqno+0x17/0x70 [ 921.169364][T29237] ? security_file_permission+0x128/0x300 [ 921.175049][T29237] ? default_file_splice_read+0x920/0x920 [ 921.180735][T29237] __se_sys_splice+0x860/0x1b90 [ 921.185553][T29237] ? security_file_permission+0x128/0x300 [ 921.191239][T29237] ? fput_many+0x42/0x1a0 [ 921.195553][T29237] ? ksys_write+0x237/0x2a0 [ 921.200037][T29237] ? __x64_sys_splice+0xf0/0xf0 [ 921.204853][T29237] ? __x64_sys_splice+0x1d/0xf0 [ 921.209670][T29237] do_syscall_64+0xcb/0x150 [ 921.214152][T29237] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 921.220017][T29237] RIP: 0033:0x45d5b9 [ 921.223878][T29237] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 921.243450][T29237] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 921.251825][T29237] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 921.259767][T29237] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 921.267705][T29237] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 921.275642][T29237] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000022 [ 921.283588][T29237] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 921.297909][T29242] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 921.432293][T29245] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xa00000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 921.531674][T29252] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:36 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, 0x0) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:36 executing program 3: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000000c0)) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r1, &(0x7f0000000340)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) sendmsg$nl_xfrm(r4, &(0x7f0000000200)={&(0x7f0000000140), 0xc, &(0x7f0000000180)={&(0x7f0000000380)=@getsadinfo={0x144, 0x23, 0x1, 0x70bd28, 0x25dfdbff, 0x0, [@policy_type={0xa}, @srcaddr={0x14, 0xd, @in=@private=0xa010100}, @algo_crypt={0xa9, 0x2, {{'ecb(cast6)\x00'}, 0x308, "cabd382f5a7d4cf39779290c69b1ad3ffec27d961a21143cf8e8f682031588646e710053d2e8c4b35e209f1716a2e46a805faf8f4214163bb2121943088eab6b41c02f0ee9c042dca7d633a201c814530b5c3a6e49bc1ed7e7aa3a8a23ab2eafc1"}}, @srcaddr={0x14, 0xd, @in=@multicast1}, @extra_flags={0x8, 0x18, 0x130}, @proto={0x5, 0x19, 0x33}, @replay_esn_val={0x2c, 0x17, {0x4, 0x70bd28, 0x70bd28, 0x70bd26, 0x70bd28, 0x1, [0x40000007, 0x10002, 0xfffff87f, 0x5]}}, @mark={0xc, 0x15, {0x35075a, 0x8}}, @XFRMA_SET_MARK_MASK={0x8}]}, 0x144}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r3, 0x0, r2, 0x0, 0x1, 0x0) 22:55:36 executing program 0 (fault-call:12 fault-nth:35): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 921.671664][T29257] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:36 executing program 4: pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x70, 0x0, 0x400, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3c}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3c}]}, @IPVS_CMD_ATTR_DAEMON={0x40, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x7}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}]}, 0x70}}, 0x841) bpf$BPF_LSM_PROG_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000be0000850000006c0000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0xe6, &(0x7f0000000080)=""/230, 0x0, 0x0, [], 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) 22:55:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 921.782504][T29261] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=35 sclass=netlink_route_socket pid=29261 comm=syz-executor.3 [ 921.797147][T29268] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 921.842159][T29270] FAULT_INJECTION: forcing a failure. [ 921.842159][T29270] name failslab, interval 1, probability 0, space 0, times 0 [ 921.854777][T29270] CPU: 0 PID: 29270 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 921.864904][T29270] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 921.874927][T29270] Call Trace: [ 921.878188][T29270] dump_stack+0x1b0/0x21e [ 921.882489][T29270] ? devkmsg_release+0x11c/0x11c [ 921.887414][T29270] ? show_regs_print_info+0x12/0x12 [ 921.892593][T29270] ? _raw_spin_lock+0xa1/0x170 [ 921.897329][T29270] ? _raw_spin_trylock_bh+0x190/0x190 [ 921.902672][T29270] ? netif_receive_skb_list_internal+0x46a/0x720 [ 921.908965][T29270] should_fail+0x6fb/0x860 [ 921.913348][T29270] ? setup_fault_attr+0x2b0/0x2b0 [ 921.918341][T29270] ? eth_get_headlen+0x240/0x240 [ 921.923248][T29270] ? iov_iter_advance+0x707/0xee0 [ 921.928239][T29270] ? __napi_alloc_skb+0xd6/0x520 [ 921.933155][T29270] should_failslab+0x5/0x20 [ 921.937645][T29270] kmem_cache_alloc+0x36/0x250 [ 921.942379][T29270] __napi_alloc_skb+0xd6/0x520 [ 921.947111][T29270] napi_get_frags+0x5c/0x100 [ 921.951686][T29270] tun_get_user+0x9ce/0x3400 [ 921.956244][T29270] ? __perf_event_task_sched_out+0x1127/0x1250 [ 921.962363][T29270] ? tun_do_read+0x1f10/0x1f10 [ 921.967156][T29270] ? __perf_event_task_sched_in+0x4ed/0x550 [ 921.973067][T29270] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 921.979626][T29270] ? __rcu_read_lock+0x50/0x50 [ 921.984358][T29270] ? find_next_bit+0xf7/0x120 [ 921.989002][T29270] ? finish_task_switch+0x2be/0x4c0 [ 921.994363][T29270] tun_chr_write_iter+0x121/0x1a0 [ 921.999365][T29270] __vfs_write+0x579/0x700 [ 922.003752][T29270] ? __kernel_write+0x340/0x340 [ 922.008571][T29270] ? pipe_wait+0x1c9/0x280 [ 922.012955][T29270] ? pipe_double_lock+0x1a0/0x1a0 [ 922.017950][T29270] __kernel_write+0x12c/0x340 [ 922.022598][T29270] write_pipe_buf+0x148/0x1d0 [ 922.027242][T29270] ? splice_from_pipe_next+0x40e/0x440 [ 922.032700][T29270] ? default_file_splice_write+0x240/0x240 [ 922.038475][T29270] ? anon_pipe_buf_release+0x167/0x1c0 [ 922.043898][T29270] __splice_from_pipe+0x2d3/0x870 [ 922.048891][T29270] ? default_file_splice_write+0x240/0x240 [ 922.054664][T29270] default_file_splice_write+0x179/0x240 [ 922.060364][T29270] ? default_file_splice_read+0x920/0x920 [ 922.066054][T29270] ? avc_policy_seqno+0x17/0x70 [ 922.070901][T29270] ? security_file_permission+0x128/0x300 [ 922.076601][T29270] ? default_file_splice_read+0x920/0x920 [ 922.082286][T29270] __se_sys_splice+0x860/0x1b90 [ 922.087121][T29270] ? security_file_permission+0x128/0x300 [ 922.092808][T29270] ? fput_many+0x42/0x1a0 [ 922.097120][T29270] ? ksys_write+0x237/0x2a0 [ 922.101606][T29270] ? __x64_sys_splice+0xf0/0xf0 [ 922.106422][T29270] ? __x64_sys_splice+0x1d/0xf0 [ 922.111240][T29270] do_syscall_64+0xcb/0x150 [ 922.115716][T29270] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 922.121574][T29270] RIP: 0033:0x45d5b9 [ 922.125435][T29270] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 922.145005][T29270] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 922.153386][T29270] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 922.161352][T29270] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 922.169293][T29270] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 922.177234][T29270] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000023 [ 922.185182][T29270] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, 0x0, 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 922.239955][T29273] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xf00000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, 0x0, 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 922.359086][T29279] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, 0x0, 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:37 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 922.472576][T29283] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:37 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x1, &(0x7f0000000000)=@raw=[@exit], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x66, &(0x7f0000000080)=""/102, 0x41000, 0x4, [], 0x0, 0x2, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0xa, 0x5}, 0x8, 0x10, &(0x7f0000000140)={0x5, 0x9, 0x800, 0x1}, 0x10}, 0x78) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@delnexthop={0x30, 0x69, 0x200, 0x70bd29, 0x25dfdbfc, {}, [{0x8, 0x1, 0x1}, {0x8}, {0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x24004094) ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, &(0x7f0000000340)) clone(0x2a0e0880, &(0x7f0000000380)="b0d5cd90b285f287e9360c59327f03a4f1e8d7dfa3a5cf0b8e455b9fcee8f5f8fa64bdda48341948f5404cb2b49ce19fd0df703c43c6c849bf9e56a384aa31b34d74ee32aa125dcb0cd1160b665a6f30fdc27ee7b787c97718e4198383f498d03f1c49d1f8397d9565c1496c440e59243ab02744bc8d8cd795e8a48672df3a0ecab8986108da4d9639059df317c52bee96237267d6f4d03569f23d2045fefb4ffb24a85c", &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)="fbab47818d41b6a023d326cf34c711a8768a9fa8848f4546a33ede0b36897895d42b602bbf731fed9d1dc124de71fe7d7b6eb3a1eb8f1b8e41a76558e645aeed3b") ioctl$USBDEVFS_RELEASEINTERFACE(0xffffffffffffffff, 0x80045510, &(0x7f0000000540)=0x3f) ioctl$BLKDISCARD(0xffffffffffffffff, 0x1277, &(0x7f0000000580)=0x8000000) rt_sigpending(&(0x7f00000005c0), 0x8) fcntl$setsig(r0, 0xa, 0x2b) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000600)) fremovexattr(r0, &(0x7f0000000640)=@known='security.apparmor\x00') ioctl$EVIOCGKEYCODE_V2(0xffffffffffffffff, 0x80284504, &(0x7f0000000680)=""/4096) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000016c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000001780)={&(0x7f0000001700)={0x80, r1, 0x200, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x6c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x200}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x3ff}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @rand_addr=0x64010102}}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @empty}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x4000000}, 0x4001) io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(0xffffffffffffffff, 0xc0505405, &(0x7f0000001800)={{0x0, 0x0, 0x1, 0xcef58b1a3c6a9314}, 0x3, 0x4, 0x10001}) ioctl$FIONCLEX(r0, 0x5450) r2 = syz_open_dev$hiddev(&(0x7f0000001880)='/dev/usb/hiddev#\x00', 0x4, 0x10000) ioctl$HIDIOCGCOLLECTIONINDEX(r2, 0x40184810, &(0x7f00000018c0)={0x1, 0x3, 0xfb, 0x4, 0x8, 0x1}) 22:55:37 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8c}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000000e00)=[{{0x0, 0x0, 0x0, 0xfffffffffffffec7}, 0x2}, {{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000fc0)=""/217, 0xd9}, {0x0}, {&(0x7f00000007c0)=""/137, 0x89}, {&(0x7f00000003c0)=""/2, 0x2}, {0x0}, {&(0x7f0000000900)=""/175, 0xaf}], 0x6, &(0x7f0000000b40)=""/235, 0xeb}, 0xa9}, {{0x0, 0x0, &(0x7f00000004c0)=[{0x0}], 0x1}}], 0x3, 0x10001, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x6b, 0x896}, 0x0, 0x7ce9caeb, 0x0, 0x2, 0x2, 0x0, 0x1d}, r0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nl80211(0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x3, 0x0, 0x2000002, 0x7, 0x0, 0xe7}, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000480)={0x2, &(0x7f00000002c0)=[{0x3f3, 0x5, 0x9, 0x8}, {0x0, 0xd4, 0x0, 0x2}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd7e62f23f5d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe", 0x72}, {&(0x7f00000001c0)="96431fb1cb11974159cafffffffffffffffe9f1f639e6a18bc7b6c1d0b42bae36740a7169721af852826d7f14b6cae8af86707ff78a1dda993aea5952f43e7e0146a3c035f0113d617244e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d", 0x6a}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68602000000de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752", 0x1ad}], 0x3) sendto$inet(r4, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 22:55:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:37 executing program 3: mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080)='/dev/fuse\x00', 0x42, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x80) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000002100)='fuse\x00', 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f756d6f64653d30303030303030004873c76f72ec9dae532266bd34303030303030303030303034303030302c757365725f68643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000004200)={0x50, 0x0, r1}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000006a40)="9eda438838743bd4e9720bee57093515dc189a5ea685e9556c1c2c3cfc4df50d66d31a48aa312663b68d18c5826b5b55fb738208863dac0f10f423aee7a5d8ddc45ebdfeb7424bae859d7c37ecfc4b63914d5a56d91017dd22bc84f759a15969951aef9d5c88c96560896988fa18cd946cfcc3a0f1c993348377904eac32c980bdf7976ebca2b499cab63c4e841514277fc71d4620e29a92523402485de0e82896484c0ae497a4d686df23ca7b68c3fd5e624d3510d7f94838e54af877ca58a00c5a672bba11f5aa1ed1980dfef47b9973d0bf456ded5e72f1702b3dc5197fce39cba53a038d8dc0ec783ce70577107dc5e8b299e64a0b7f1191f0926bd25762370191710bab2f44e9069f55f8a3f87e4cb488a2fb3348c0bf3b3874291f83e4776b160ea73aafa3919c7c069c73c0052173a63158db8b65541d161f9c964926ad7f06bdd6cb6a32135b04e35701c2e13c49c1f75dc7a25d623378860692d172ec3f1e1f2d9dc77c015c13721efcb101c2390abb847e871132f472a37cc0163b39b1d575a5444e246a08a1afb1a696cabab29498a314429a3b9f44c43ba29f71fac1fbe0d01c3c16d22730932704bcfb0c1b7a432bc51dd3f5dd5afc3b342cbe6a6ff899039e28f9a51881b1d46fdcf31767cb6f5c5c69ab3c80615d77c4d1664fc4ec831b8cea2e752bbb7a9ce79df875b29f1e232751daf32a1a0c4ff8bd0688e2b8e2d668b8a77e20a9eb6ec2e2c23b94e507baeacbcfa31fb6e1ca3343668f43e3aa6d85e7c29bf0bb4dbdabddc92be7f4a6f5d21b19e6da17bfb6cc926e3847532fae29c7b62fb909130ec372d3c16cfe6aaf3ce2af0fe7610fde7aad61bc80d2f96b999c8ccf6d22cf903ca8ae8b879ec4a416f334982e9810c0140a18d4dc81b5edaae23e9f4abaf40ed71512aebbba5bb251545e188db789558a845a2877b14bdaeec3c738b7d730c0860531bf5517d4f0e8f95ed3571f8a35816d5116fcb8d7cbf42b7d5d5e65541508c898bb2e0fe96297d2ab7135662de39df099ebaed5871111f5346278cee5728cec512e6c0a0d65b51e3d627873195b84103341c2bc83b6c8fdd8ba17f5957413f61c69d618c9b9d0b1f08dc81921b6c662ee1da3bfa019b095e9a03c2db4d645ccb7364e895098cbf7d932c72d80663c7a1694d122f7348393079223c11d36c64a5856eae0397ab9a9d948204b74e56525a9d552dd0916de81cbb5af3c59b3d7f8f9154423ce2cb45a5bc808e24bef13212019a19545fe54ba84d01534358380192b8c7b0eda907810375bb66a578a58fec392b47991271c8367b91d710e8a176bc1a4e96f0e137d4c25fbb03eddc392f9f170dd744472b864fbbae7c93d86e682308b21b73c5652065d72cf02e1152b44024a90a3b52eb0bb3cb412e518d37a68aa4c7f46789c54ab30d3a73d0a8712fde612294cda2aa1ccf164930b9b1d17801d4fbb06e849d39bf2b5141330caa0d2618b616f1c67e1ca57080e79ed9092ba7a55e8121cfc825cd26a0199a479a7ab1b7b23d2a4dd82fa6d04ee41ca680435efc934f0451e865e8632ac2f1115f4cdd33b0fccb7a2326127faf20cba37c828613dba5a98f4e1ad25eb6b91078cf73d873df9ef91531476f64b83559ff7ccdc4c070d478b18196ea05fe8d4ea0216ee5273dfabbd04582f40f064c9781afd2cbf30901f28cd09cc934f1b2d50883778274177e3dba8af0a1b931d80ce1a6c4085780ea2195b65ecfd2953f78a5290fe560d0cd6a5e73890a5a82dc410b92a3ef2be05ec5607820fd4ca6b9c3aa258d59022fdcb21665f1ce4e8aad8fd918c43bd3c2afe3dc223ff9f48831d401c8b6996190793d1dd7551f8511b69283992398d8f9b4bd2b3398d3b8c6f3c5d8b802ca5282b70242df2b7be4b38e70c3065f8da888631375afcc05ce578089c4f783776b286b7a60d1b5e189e2742a3240c1036a953d886885422eef01413c38099b64505fd5a73488acb4e611820674c58ae74d6c64a885d4beda9bd7903bcdc71e3711e2a057c0eab2100c321050ab14c6e453c53182577ad3178603cd9afde40a701120e9a36074fd582428c74e02781318e6c65450f8f020bd22475696fe13b8c59260e53a06d16eabd135e887a0a6bbc8ad21be7661df76fec5b13844f68b8eed1a7379713738beac9f23c7a26520e19797a910cde9fb285179526889b908b7eb49bb06f70f6271fba8712c1a4269ebcf4b7d043e924e3d2c4c753fd7e547d95841e335179836f76424e728810d7f32b78256ea30c79d9238a6588426e1f2d4c0b03d5605bd826ed24f0f11326b4cf958632b86e017aa80e142db1580c44f76d9c98196f3f6852ab2bfc6a01a3553a130c2d171957f5a45c3550fbbc990ef8742a98a86b280a57b9f198ff436bc01161ada50e6f23026c3254adf2321bff7e20aa54080bbb57d8d52c6a6df6107706a2e5bc6da68f17b474c0edd39401d765086e885cf7992405f856557915603cbe8894676e996bbadbb649a5e7498b91f9bd2f697dd9ebbe4d386050258b9f4c94781e61c660651c3f1e3ae51f8c035eca365bf15d6db48ea9ce183515f4a208d010f7c23dcacbd6e225490d7e9c133525f5c9018d752b21b4897bf18b64b6a9936f538a0a8958fc934440aeeaad2b68ac844d76f0900a6c95bd0b353d85d4fb62eb88360112237fd8c636a80e3130b21d66ae8ec58a4b76cba0602f96da919f7e84fd37e3ec2379f58e389a39c78d2482e03c379e3c4649ad63a76e3707ecff07d2fcb0c9dfc524cab49e69a09c92e4f88714335cb57d3f6184d07bef9657280fb5c9fd2d8f940f7ac6c5407e3077aa2e4ba8e217e0ee19e302d6d90e3be05a86dade35d2e454e511afb5cf5936f1d11f2fa6be6ceaa817dbdc7a6aabf2fad8ff3efa8382a25099f0c5989d2ad56ae0f4968b2cfcfc67b4f1c161c75900b4848f59a3c0376dfcb7997bf28e9e85d6dd942a360516de38e1c1a038a796f9a77ff2b0c7e5e8f4932391a0e58e76dacc6f9764178a211dfde3e75d367d2911ff398126ffdf83cf2fbdf1ad5232bed9155f7a168638a572094a9e934d4969b358cf6e121d7fd2aeae2f499068b42c152f0e3403a230885d6f92f038ddaa23499f804ffb06abdbabb51f6c38c92fb1a6271a4b13d6d11125b8ec12efa5907dc65062797fb9cca15e2f254e76b182d3fcdb4e96ac4de36d6df7e7bba5c32f422286b1be3b79bffb6fd693761952d195a84ad9ceb07287a0fbefab9e0347b513c5f60233ccd4b52d90ec144a2f896d9dc7f279f8aa93038f3efa286e1c3006933a4d7183d952f8d28b141b28b2af355b5bd8198dfde1ffb8d09202aff0d16ca3fec194662892a49f829813970a4520f1228aa03d211a45bed3b2e05bf1f10b1a152761e7b6c6ddea863a3c02224256092c70ca70dc185c4c385dd98b09e2682661e1e66f71d9c4037048eb70e8a1cbe57de87ec43713abf5fdcf63b9c482f318e3bec37e878dadbae15a02d731e6c8574eb14c059d72f73be5174add786d06b585a28a06d349d8e434a491b34897b3c1ad786ec8280d7f57edd4fbc6aea5485d659b59d393e331cf91e6ed76f340fcf7cf460892fa7318fc42b883f61d888ad982a751accb613c66661fba5f3d6de751a6a9ef8a4700316aaad04e991aab7903f4ef012ec2a8c092234e74ef335daf360ae47bbd2bbc6ad8c1a4f81efe8bbd703cb55ef36b32b4e30cb5a3b165c02ba295d0e1c40ce6ff8f479a74f01275f113ebfa8ade37a59ce70e6ca2a6f48f1be085f61bf772e2c2da523a2cfe63e99c57bdb1ff23139d4fca49eff7547e9880eefd3f7511a677efa23b52098ba89037c48dfcda2e8c1cfb9f892161049e53f8cee55256279512aecab8c441600dae0fd957883273047cf5c66ba209f830aa2ce0cbe41ca08c0cef4aed7f4324009200661a7ce680e5a8df2d051c1d8b2f63d25d8d74d05c75c46c8f3f24d625539e63459650960498a54ec3b16225bbbf4d3930009df265839d72611f5332a904cdebada108236e4414a2909ad01ec44b9d7f75de4385ad7ca5152e890a0919b3639fd1bcbca3b737ebb8d9ae541b1271cf2166ba15830e66f3d3afd3b754a7f81ad4f0999704ae99c114907c5be4a4797f13b80564f234723a34dbe137dabfd7fa23562df679f54a6ab54def6d63deae9844f72fd73efd0413551f5c4b9ee826eb3b7faf92a59ea34a16723b4fea14d1c8815a4e2d39fc48d1dbce526a7c53f5a96d0ef6463a0cee73fd3505f5c764a264b83c4a21f80e8b61c82d24442d13da99d18dc1b2538e7a510f6093d9ef2bc5cc777d4f98411e93919eddfd69d6e20d227cb61c50f358ea227f4de941fb080c1cf6b1f6e25533768fe133dbfc3f9d29c603bed38aa3c5af5b81a706b0067b40b88f992610d04c7cc36b8f649697cd6a93fae51138161891ae75a7147780fc59af5a6e18c54f9d2a4fe7fa92314b399afba9a40d0cc24f70a2593acf8d179215e06b7a9a88224bafcb2cbf60caf5fe4ff38208a70793b5dc33cd572956260e1c86312d3ba9b3a4b2b44376f2e78c616a6c0880ac8dcbaa30b9f761d500fd03a8518dd0509157b184a2d95e0caf3ffc8ac2db6c54d80c71a1e5b9ea3bf51071e2118af204123daceeb04e4f6f31f32a4d3fbb76ee49440cabda2c121c1b99acab5b87cecc37c3f9066af34ab29d6598bbfd91047a2ac7ce3a8f3027ff5e6d743506f161087278896a98ed37122ba208b61cf54d3929555ab06b564cd5e4f46f4755a6cfa2ef2b30d29ea66f2749d4060d411fa9160c91b6f55cf071ac8222c6313df18759e2958cddfe3db4cbeb9cd39abcf5f0beaecae8437813995cb7ed0b87d42ca942ff7245ece204798d01361c5f008e0d82bdf76660515bc78f7f8f409ccf68614b2cb50f5af2615661326fd971bc57eeeade60ea906b8df1cb0dfafd318cd2c396309c329d0469ca192aa8f51d7c4227685440f073983255baf054b97b9d7be1d1470d7eabd5c09b2116b4e86b0567b7e97e088717a4fe3dbdd310a1c39136ea4d2c47492001f9885dba03bf97e7da376171d666441cdc2f999db137603d57df32b4260fa0165e82917bb1631ea314e7a7437e66fc68cef22cda8f456d6e583f6e3237e0bc79987a9103f7cf0918e26881f67ea582e1ff3a49177599d385bf6e42572a2547933aeddb826530e9adf30dd84c3a7fae5c4c26f6c6f3a9f0906decd314e2407825abef959c5416d18a92ff34e6c521a16e8a0a29937c77d4ee99b41d530a732acbe0bf5d274df9d496b47a9a624546bdcf9976cde12ec989cb2a70b33a7c8a3a77652023164695f9db30dfcf587f0cd4f73e385730bcbdd688f6dcb08ba0efbb9f579220afefa4acfea522e864fce9b1782ce9f14824d16e9d33a2609c23ba3c5a1af02549357a0dcc12e37819d778021762cf895abeac1125b744c8b8225a091e7be9ded9993cfa3ca9abb83e25c8f559009977a2ed9374a89619fae5ef6d164bb73d242004dc8428e44689b33ee3bbe88bb4962ab0a32a90e7aea044f08410752cb2d7aeaf3196648a3a99092665b478bb394b48f79b36db0efc7f50d6a5179c945f5298cfaac5e5dea715296f92abce7281d48a0c9c6b785a35ef5f1697c047ddb254fe9a8ab9f498b0c1ae09ffd01a3d8d427fee7e36c51e0e5c2fee2245fb8464626ab5c9857ebce91f7d22bf024d10c2d71021cd69268472de419e6cefd970cc3a8e4d1bbe6496799aa7f100411766e712aff08b731460f14f9d7356db12cf8e1c6121968dc68b1d81c086b325ca4ce6fe1f476707e08fa913144b757c6be17cf93150db29544d207f09a896f33b7335d9339215da751e7af2c6bdd19db6f521af2c8a5998dc607f97026d07111488741134c1c86eba123273d1fd5ee4b471e86f9ae9478a04c7482076ab34a1eca5c64f89e5106eed44bceec019c67c12fb4db4fdac153f4ac3b63ffeb6d30de58ec039e2dd3c181e254cd94d0a2b0b44490384cc5915b54ee1db2b6d059879bf8126c9ca976d0f7862da07ecd350930a081810a7afd72b2ad3f65b96ae9c7f91227a2b5513a559f36b90fe01be9ae5ad3ca65e2c26f358fc26b858a3633fda7ae49a5fb705220a5819b3cca41b1ccc21d7c40f5fa9c422288efa5394e4312675899d704a2aab62b8363f58fd4bc12a8bea6ffc45b4414237bf5f019321206dbba439acb5ef26641f30fdac20f964354bce94e4c9d73e137f9806deefaf6f4acaa0e76ad4fef9f6cb7fc01bbabda9612c05adbe46afcf94819e8a4b4b49ff764784fa432d47fb6d4230900043d1b4521cd6839fe8c5df4d1899fdfb13880e207cac73f0a29020bdd563bd9c2f6bcd1ec523b3e03ebf6164fc65af001830c51396f9df2d346f83a59cfc82201cf1150ea57259d579fc2ed199b3fbe42d5188c84e4354610743e5b23a265246313cc63913f17412fa00d98b379b80b96d936969572e11316bc8926cb23115186f3b2387b82c3898fa41bf16a308da62d5a3eb3609af1943fddde08a4036eb2a41b7292caad9eb082614b02a1fa255bc7abd4d0e3b4ec1801e131e68c7aa9da1a0ff10f9de87dec8fad1ad8bfa99caa49e203a7b9c33e044d4544a537471e7a452468b821959bc488c6b8cbf81e90081a26de273ad1203cc06adb6af242ab19f96c1c66b58c37e2c9309704fba63af99a8d9c5efc651afb631fe9f546b938cc3b8e526c4159e5c9f7afb29fd1d55fabf09367ce2a63a35e7a2062d1c772ed981fd77157a847f687a177cf9886ce41df8cc509302b46bc1e2ba896b1c1656a1bbfdf4cd9ac39cf8510d1c823075f16550fd044aacc8d42a56f03718f7b18475cdc3999faeb25ab3dd8a807ee04d8e5d831d08b4e309dff50330685138797e10c6362636f53f22bfc1f3d5090a5d369282d9de36bb4e2505411ccc6ea395afa1567b15a2fb4be2adeea7126b1a8e80034105e0d98bdd78e796ce1cdc06a4ae666fc0baec5c52614340ed997673e26ec47c88846c000bb7c9077337cd44f5c041fdcc64986e5e1c0f488148f0ee6f842c44c0b72e82109270341bba6e9080b70fcf930d0f10be5a36798e70111fed72727b72282ff164fc08319d74f1f57cde71b57cb397a9e753f87b97729bafba017a24cbfdee5dfe7fc296c112e93bb8fce560ca80a3afd8370baaa79ad783b51352b5440b144a47378c9ae22eda5794328e95bcca220fd07bb56915529b155c61858efe89ad36a79288e74c0e251addcfaf797432175a5562b46eff5e3aebeb74623e18beef85389383c604d8884431b07dc4bea0174aadc337ff41f558a63f16690feae47efa2a5d1318b7397e1e4ba398727d286791b71610e1d78d32800e7e113c12abf0f60b6ca4401ecd23b7aacd990633b2b017daf6bfef1b2361ece74b7dbcbb1a73d4bc1f9d2e5c9fb0b7980d25cc44d1b10c09ef5a6a05c84669294a5cadf0cd88ab449f9f0bcdd8c48590d416c5c1feaa494a2145949c2a3373df7c6014225f2745bbeb20ff294d22c0d96ca111e6926946207cab56a03162a49e68968e398f70690188ee3ca847ef421742d60b9a6ad029e8a3d607950b2bf8ad8ff297cb39acc94905635770436e134435e28205140331b5100d9f64469792fffac87bca0835cbc617446ff86a7b50418c305f32e658b32130e491e38709fd3697017ac8084cdf1ed81a28375aed092ab4e32ca88a933154dd3a9e99351acbada926b67b310c7070ac1a414a28c5abfe1f45476249a12f18ca2d981528d881ed3c5072e46a6eff3cdf37dcbc89c7f79c88a1f8d15d15beb66a0e4440c7b93e379c4e2bac1d5c8e85f1852887e2cfeb178fba1c67dc2adb0c87df8ca4444ca7f455509f492effb5001328b8cc696e2933207a2d78bbce8562ca34a248193c914406b161c8141479d891b0c6110ec1e25cad38299b489f2ec437017cadba67dcb58abd4933c95b3526f1d4747b8701a7d71e446e4b62e2941d4281faca0cf22914be5aad80f47100000000ceb24e82508fe55a92fb6db70d03d1c1ec09cfee31639341756a4630a0eaaecac7bfbddf9d30c42cbd45eb181d5bd341307ad26f496bb042e2b655c03ac3dcc587acbf50f79b5c239be9938b62d3251b199f8413b020605d5d0552cfd9c39c9132719d6d0a326b000e12fcb51bc274df79d11430060d05978cdd50583f1bca82c57dbee605e2d00fcb5414af13a596d35cb5ba62de6a28cbccc857d23547b1c7fd5ac8fbf6758d5b8451fa46d9acc00344dc2e565674b1dd3547eb8f8aa5fff99042f8d1d59e6ad2f53379211e6832fcb68f5777eb2db85b28f724f4e4ce6342cf55713ff7b0cb4f7f47dd12a6566b86709eaefae024373267ce72a89e7f3e42ab48edcccc96b5d0403fe93a927e5ccf470014f220b8257393226cd7b996f20e6a34f81206733a9fdce03b701943c1b560d3eab68c2c225cf7f7f2b56123be2bb173e9e5b37f4d3348f6b987764ad07c2acd44514ff264d7eda31e5e517a179414841ad4553d51c08f435e05f10aa82d74b97a9ba3a133e6c9175fdcd4f3dc9c16d3be1d5bbaf13240177081ac1d56681bfa988a93af09868afd608520c0bfd71d857a6661fdaf6f2e166987eb007449dd26334ae932c5003fefc0f983b9e49cbfcea325f2de16a9ae935caa46f5b3433957fb370971ed957f138f08a60fed5b84995e428e7ae7d5c22021ff016baef0e713a118344c016a99ad469313ba7f2452da0dd82e019f64aa229cf80a69b3e08ac5847f10d247179855546313232f23e055c2f74ecef14e0fdcc29a9bf0976fbb249bd5c7903183d2a53c70960a183630e7d4928daa7091a85ad987d2a4a5b8f6be6612fa72d9fbb33c67bb38eff19f2e784f94e0354cf6d35a5b2c62233c039de3734b38e97ec72bd673fef09fd56fec329818cc68cdf12cb52f7d37a8350c16e94208880bfcd3e895d7aa4489e3dd15db4a9026f0d2a46f1e89c35845dbd976a1992b87c15a0c7580e6424b8792a7bb7b933d7c5433d4133ba4dbbcf7995d6ed3feaa32f876a287feeb9cc6107778c1f83e0119d980b9e994c2a3ae3de24a103efb3cacb746b49d1ad85746b233ab4aaf0e988ec2a786bc93f32040d3bdc3008031634cdfded5ac95b2279e096243228296591e7ba53c4a127772cc4620e6b238ccad250629194533d0a669ff3366c52d64928693e0b0cbb0b8e2c6029089d4dfe2b4b6c5dcd85f1a02770611e65001e48a32a8b0431a3b9d77fa3a95be38a0436a704c05a8e0183f3214c25531a63796f679bf72885aa766468d42b2543542d7e82544efc5c5e81e6a91a0f5d4e68000cff687d63e45c9a11d4ef515050daa592c9a828ac7c0488e7cdb3d6fdaef5e9176ee68d981ea50d386d74df3b40660351736deb03bfceb721878cf9894b0302df15964242ab6b9f77f98ba1c7993735983d2b022600ab74a19e3636e1400d08ba45d3a5c2774cb06a1c358bbfc11d27efaf7ca53c2e7757c8c76da24707d91a4a5244262898d68083ff91c514d9b9b1ebaa0cb0b10254fda1b1e82b9a1a47f117b5b280ddbec1f6732d11117ef1a7a674699df87fe795d1243cb9c4527e364e2b711b6562a87fafc130ce0baf1701686639b05f0c8dc708f008b1e6ab89e8d623bb83f3d54b7bcdbdacd055ac4eccbd36bbe0af0f65a00e3d6dd985ae8851d176976cfb5816d1fc2a63d3546aecaa4e712ca6961d1f181315d553de6b53485faed0dcfcf819a1ba3badffe797377d3d1ddaed8e7a0acc0c3d277762262a139f94de49faca167b11bf04f2104a5ab9a73367a6461f7124c91a2c4229ef98e6ebde9aac283c7d029400d71293f488ba169b62c1e94689cf5b248ed4aea62b88d65bb764cfe27d5231a58486e7381df518f4ed81cb905108c54a5050a94ca0e94da20d3794bc5fab9127dc95b6404b1e27b4e28136fc27806f7be798444c33aca88ffd45b860eba0d5033839f5a092863954604f1952bd61dad23b11643fe14f3ade08116aa2c13eee701ccd13e506bd65a1060bf69579aea8c8143cd38c0891a3065f251eba0c20ab9c69ddf28e3bd6400cc203bac8de1882239ad4e1b97b0ae2f1abb7bac7c0d8ef82b97ebfb1f5577f06a3a1377b09ada4db87d342f20ab0eca4b9c206042471307511429cb57a578211f92d3647189861cad9145f5eb26ab696abe50a2a6c1b469df97da28aba4e79b586c348a430f5ea61c4be1032fa61d18581f05a07fb8707c8996e0fff1c3eda59b992687fa12483b9327e10224b20d42e8b3fc4670bf070ced602283273d6818acd1f6da567c44d3f5e1377065d43d87d889843ae48e7fa8ba1634815695b8c480ca271e6e833799c70da80fd79acc09b989667a2294de5da73f0363df9a33ad4dab8d27cf7bed0a06838672e3d07d52b6396e9b5576021d5e925abd533bf161c944795065fdd44e8462e3070c479f1c118276653488dd9b2f1a673f8cad3612ca1fab4388ec9c8f834a01a499adb7b3a9a977672f6d75b41bbdd7f91ceb7e7a88568d17bb432be9e4e96e115075bce197ef4754d2914c2c59e2d7f4c08f0dbe34d31f229428f211bf1d7e8f5c319ed4a8273cb6255eb318851ac4557b0278fac63107a54d407c42f300b843a12abd3b893b46c7efac2e388ab42b87aebe2543bd4c15f459bc50aad10ffe1c1196fb52c26e54bdaa7fbd52451f207ffb073ef4b3f71eedd7da40c89505019739e3fa733bcdc84ff4919e8fe2358129ef28291be1d6426b8bafe88463b1d3cd7273745381c7f65221898e6ad361e88b24c54ccc7ac9a830145b6dc096e2d71ef71ec4f03524cb870b724e08d223bdec2f6fdde6200217a13b5136004d455d66547f5a1793e0cad85677d49e5c558852107007c8136812cf021afaf6f7e8f59883371be46cda412dd9c6fcf187c31252ceb5758901d39cd5355ab386d9a7fe6ea46ebf277aaf809c3023211ea9aa189de4d422080ebb9fec50ffab6b95ba4ae5018accc497e79149ed6047ce561ccc10e9194cdccd5c9fb75175c8dbc9d0a916ad59288f010defbbb50d263041ab37aac0f93253bef6f898cd0825d99d27224f26181f9713b8979da64756c95e7505f25a2688960d6155c3613dcc31b6c337a6dbfc6b12cfde1db22b93bbd5e48534fb0bda8b212577a14dcf665c834b0bd24e5f624d2455fe048dbe930328d7cb632db3b0e244bb5d43390b420b15157a339487fc78976f867d3a361aafdd3f50a93c01882da7c220089a544381db22e2c86b228dc2be01820468460437588952a549d37498e529e62aa62bad1580546bcb1e9a6ed1870b7838d05d12f6e3a041e78b1bdb80894626f20889ccb3a468aa4fb24b9c87cbb28623ce59c6b3c6286db366d08004551a25fe4d8d194a2bb7c52e1c85a5fbe4cb15b171489da121bea1c469a6bb185d63213084e3a81ee54dc03a94dc5ecdda7bfaad1df68021aaf4627c9d529f13e5c81b5ee4dd228949ca16b9a61d186211d153294470907557e5e14ae665013f285fe4d3766e7b3d8ce5e2a14692072d4d8f79354bcc8db8a2a36c8bcd", 0x2000, &(0x7f00000069c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000066c0)={0x90, 0xfffffffffffffffe, 0x2000, {0x7, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x87, 0x0, 0x0, 0x73, 0x0, 0x0, 0x0, 0x6000, 0x0, 0x0, 0x0, 0x801}}}, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000002040)='./file0/file0\x00', 0x0, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)=[&(0x7f0000000140)=')#(&\'\x00', &(0x7f0000000180)='%@#-\x00'], &(0x7f00000002c0)=[&(0x7f0000000200)='/dev/fuse\x00', &(0x7f0000000240)='/dev/fuse\x00', &(0x7f0000000280)='/dev/fuse\x00']) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000000)=0x3) 22:55:37 executing program 0 (fault-call:12 fault-nth:36): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:37 executing program 3: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @multicast2}, 0x1d) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) sendto$inet(r0, 0x0, 0x0, 0x2400873d, &(0x7f0000000000)={0x2, 0x4e23, @local}, 0x10) r3 = open(&(0x7f0000000100)='./file0\x00', 0x400100, 0x40) getpeername$unix(r3, &(0x7f0000000140)=@abs, &(0x7f00000001c0)=0x6e) r4 = dup3(r2, r1, 0x0) write$P9_RREMOVE(r4, &(0x7f00000000c0)={0x7, 0x7b, 0x2}, 0x7) [ 922.603385][T29298] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 922.605051][T29300] fuse: Unknown parameter 'rooumode' [ 922.619701][T29300] fuse: Unknown parameter 'rooumode' 22:55:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 922.721741][T29314] FAULT_INJECTION: forcing a failure. [ 922.721741][T29314] name failslab, interval 1, probability 0, space 0, times 0 [ 922.734700][T29314] CPU: 0 PID: 29314 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 922.744846][T29314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 922.754883][T29314] Call Trace: [ 922.758156][T29314] dump_stack+0x1b0/0x21e [ 922.762468][T29314] ? devkmsg_release+0x11c/0x11c [ 922.767385][T29314] ? show_regs_print_info+0x12/0x12 [ 922.772564][T29314] ? __rcu_read_lock+0x50/0x50 [ 922.777304][T29314] ? _raw_spin_lock+0xa1/0x170 [ 922.782082][T29314] ? _raw_spin_trylock_bh+0x190/0x190 [ 922.787421][T29314] ? _raw_spin_lock+0xa1/0x170 [ 922.792160][T29314] should_fail+0x6fb/0x860 [ 922.796547][T29314] ? setup_fault_attr+0x2b0/0x2b0 [ 922.801545][T29314] ? setup_fault_attr+0x2b0/0x2b0 [ 922.806536][T29314] ? eth_get_headlen+0x240/0x240 [ 922.811456][T29314] ? tun_get_user+0xc08/0x3400 [ 922.816192][T29314] should_failslab+0x5/0x20 [ 922.820677][T29314] __kmalloc_track_caller+0x5d/0x2b0 [ 922.825934][T29314] ? __napi_alloc_skb+0xd6/0x520 [ 922.830839][T29314] ? tun_get_user+0xc08/0x3400 [ 922.835579][T29314] pskb_expand_head+0x10d/0xfb0 [ 922.840417][T29314] tun_get_user+0xc08/0x3400 [ 922.844986][T29314] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 922.851287][T29314] ? perf_pmu_sched_task+0x370/0x370 [ 922.856536][T29314] ? tun_do_read+0x1f10/0x1f10 [ 922.861275][T29314] ? switch_mm_irqs_off+0x46e/0x870 [ 922.866457][T29314] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 922.873015][T29314] ? switch_mm+0xe0/0xe0 [ 922.877226][T29314] ? _raw_spin_unlock_irq+0x5/0x20 [ 922.882307][T29314] ? __rcu_read_lock+0x50/0x50 [ 922.887040][T29314] ? __schedule+0x8ae/0xe30 [ 922.891567][T29314] tun_chr_write_iter+0x121/0x1a0 [ 922.896565][T29314] __vfs_write+0x579/0x700 [ 922.901083][T29314] ? __kernel_write+0x340/0x340 [ 922.905912][T29314] ? __kernel_text_address+0x93/0x110 [ 922.911287][T29314] ? __splice_from_pipe+0x2b0/0x870 [ 922.916469][T29314] ? __kernel_write+0x2b/0x340 [ 922.921211][T29314] __kernel_write+0x12c/0x340 [ 922.925879][T29314] write_pipe_buf+0x148/0x1d0 [ 922.930530][T29314] ? default_file_splice_write+0x240/0x240 [ 922.936312][T29314] ? __rcu_read_lock+0x50/0x50 [ 922.941061][T29314] __splice_from_pipe+0x2d3/0x870 [ 922.946057][T29314] ? default_file_splice_write+0x240/0x240 [ 922.951837][T29314] default_file_splice_write+0x179/0x240 [ 922.957440][T29314] ? default_file_splice_read+0x920/0x920 [ 922.963127][T29314] ? avc_policy_seqno+0x17/0x70 [ 922.967946][T29314] ? security_file_permission+0x128/0x300 [ 922.973629][T29314] ? default_file_splice_read+0x920/0x920 [ 922.979320][T29314] __se_sys_splice+0x860/0x1b90 [ 922.984148][T29314] ? security_file_permission+0x128/0x300 [ 922.989839][T29314] ? fput_many+0x42/0x1a0 [ 922.994136][T29314] ? ksys_write+0x237/0x2a0 [ 922.998614][T29314] ? __x64_sys_splice+0xf0/0xf0 [ 923.003459][T29314] ? __x64_sys_splice+0x1d/0xf0 [ 923.008278][T29314] do_syscall_64+0xcb/0x150 [ 923.012751][T29314] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 923.018620][T29314] RIP: 0033:0x45d5b9 [ 923.022506][T29314] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 923.042084][T29314] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 923.050463][T29314] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 923.058406][T29314] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 22:55:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x1500000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 923.066366][T29314] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 923.074307][T29314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000024 [ 923.082264][T29314] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec [ 923.092813][T29318] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 923.180736][T29327] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:38 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:38 executing program 4: prlimit64(0x0, 0x0, &(0x7f0000000280)={0x9, 0x8c}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x22, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(0xffffffffffffffff, &(0x7f0000000340), 0x41395527) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f00000003c0)={0x0, 0x2, 0x1000}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4}, r0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003240)='nl80211\x00') sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000000440)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYRESDEC, @ANYRES64=r4, @ANYBLOB="d5e4060636d829791ad4b221a34b5172d9b9d391e43c8f5dd3dd8510fb0cb3299783bfdc2a363327b2b66a3efaf6777dacf4e9e80a04dfbd9dde00000000faed0ab327215967a74233f5e5f73b294f94cf8121b56f219ab391e769b318f39434211c9107b08f0000000089ac27b039c7d9bf39dc52841fbc0b2f13bb5d85000000000000c96c3972627ac367a0c55da96e3f14ed45c67f8e95cb7e8b54700e05d4ba948fd37eac86fedd7ef0a28fba746586126516c35dccf01062e0484fe149cd963b7ead1ea3d2cccfa13cac0217d255", @ANYRESDEC, @ANYRESOCT, @ANYRES16=0x0]}, 0x1, 0x0, 0x0, 0x20048040}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x3, 0x1, 0x2000001, 0x0, 0x9, 0xffffffff}, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r5, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) writev(r5, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6170eeecf067b32425be000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3) sendto$inet(r5, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 22:55:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:38 executing program 0 (fault-call:12 fault-nth:37): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 923.458570][T29338] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 923.584806][T29353] FAULT_INJECTION: forcing a failure. [ 923.584806][T29353] name failslab, interval 1, probability 0, space 0, times 0 [ 923.597490][T29353] CPU: 1 PID: 29353 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 923.607615][T29353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 923.617641][T29353] Call Trace: [ 923.620904][T29353] dump_stack+0x1b0/0x21e [ 923.625201][T29353] ? devkmsg_release+0x11c/0x11c [ 923.630126][T29353] ? show_regs_print_info+0x12/0x12 [ 923.635302][T29353] ? get_random_u32+0x112/0x210 [ 923.640162][T29353] ? kasan_init_slab_obj+0x20/0x30 [ 923.645290][T29353] ? new_slab+0x21c/0x450 [ 923.649587][T29353] should_fail+0x6fb/0x860 [ 923.653969][T29353] ? setup_fault_attr+0x2b0/0x2b0 [ 923.658961][T29353] ? eth_get_headlen+0x240/0x240 [ 923.663864][T29353] ? iov_iter_advance+0x707/0xee0 [ 923.668859][T29353] ? __napi_alloc_skb+0xd6/0x520 [ 923.673767][T29353] should_failslab+0x5/0x20 [ 923.678246][T29353] kmem_cache_alloc+0x36/0x250 [ 923.682990][T29353] __napi_alloc_skb+0xd6/0x520 [ 923.687721][T29353] napi_get_frags+0x5c/0x100 [ 923.692279][T29353] tun_get_user+0x9ce/0x3400 [ 923.696850][T29353] ? tun_do_read+0x1f10/0x1f10 [ 923.701592][T29353] ? unwind_get_return_address_ptr+0x130/0x130 [ 923.707710][T29353] ? memset+0x1f/0x40 [ 923.711663][T29353] ? unwind_next_frame+0x1c07/0x22b0 [ 923.716916][T29353] ? __rcu_read_lock+0x50/0x50 [ 923.721645][T29353] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 923.727696][T29353] tun_chr_write_iter+0x121/0x1a0 [ 923.732690][T29353] __vfs_write+0x579/0x700 [ 923.737075][T29353] ? __kernel_write+0x340/0x340 [ 923.741895][T29353] ? __kernel_text_address+0x93/0x110 [ 923.747244][T29353] ? stack_trace_save+0x111/0x1e0 [ 923.752254][T29353] __kernel_write+0x12c/0x340 [ 923.756898][T29353] write_pipe_buf+0x148/0x1d0 [ 923.761544][T29353] ? default_file_splice_write+0x240/0x240 [ 923.767318][T29353] ? __rcu_read_lock+0x50/0x50 [ 923.772049][T29353] __splice_from_pipe+0x2d3/0x870 [ 923.777040][T29353] ? default_file_splice_write+0x240/0x240 [ 923.782813][T29353] default_file_splice_write+0x179/0x240 [ 923.788410][T29353] ? default_file_splice_read+0x920/0x920 [ 923.794111][T29353] ? avc_policy_seqno+0x17/0x70 [ 923.798931][T29353] ? security_file_permission+0x128/0x300 [ 923.804616][T29353] ? default_file_splice_read+0x920/0x920 [ 923.810407][T29353] __se_sys_splice+0x860/0x1b90 [ 923.815232][T29353] ? security_file_permission+0x128/0x300 [ 923.820919][T29353] ? fput_many+0x42/0x1a0 [ 923.825224][T29353] ? ksys_write+0x237/0x2a0 [ 923.829714][T29353] ? __x64_sys_splice+0xf0/0xf0 [ 923.834547][T29353] ? __x64_sys_splice+0x1d/0xf0 [ 923.839378][T29353] do_syscall_64+0xcb/0x150 [ 923.843856][T29353] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 923.849721][T29353] RIP: 0033:0x45d5b9 [ 923.853592][T29353] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 923.873164][T29353] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:55:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x3500000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 923.881567][T29353] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 923.889507][T29353] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 923.897472][T29353] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 923.905435][T29353] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000025 [ 923.913467][T29353] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 923.982259][T29360] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:39 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r5 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x78) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:39 executing program 4: socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000029000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r4, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) dup2(r4, r5) ioctl$EVIOCGKEYCODE_V2(r1, 0x80284504, &(0x7f0000000080)=""/81) 22:55:39 executing program 0 (fault-call:12 fault-nth:38): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 924.364435][T29373] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 924.446958][T29386] FAULT_INJECTION: forcing a failure. [ 924.446958][T29386] name failslab, interval 1, probability 0, space 0, times 0 [ 924.459737][T29386] CPU: 0 PID: 29386 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 924.470030][T29386] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 924.480058][T29386] Call Trace: [ 924.483335][T29386] dump_stack+0x1b0/0x21e [ 924.487637][T29386] ? devkmsg_release+0x11c/0x11c [ 924.492544][T29386] ? show_regs_print_info+0x12/0x12 [ 924.497714][T29386] ? _raw_spin_lock+0xa1/0x170 [ 924.502445][T29386] should_fail+0x6fb/0x860 [ 924.506869][T29386] ? setup_fault_attr+0x2b0/0x2b0 [ 924.511863][T29386] ? ___slab_alloc+0x297/0x450 [ 924.516634][T29386] ? tun_get_user+0xc08/0x3400 [ 924.521364][T29386] should_failslab+0x5/0x20 [ 924.525839][T29386] __kmalloc_track_caller+0x5d/0x2b0 [ 924.531107][T29386] ? __napi_alloc_skb+0xd6/0x520 [ 924.536050][T29386] ? tun_get_user+0xc08/0x3400 [ 924.540783][T29386] pskb_expand_head+0x10d/0xfb0 [ 924.545604][T29386] tun_get_user+0xc08/0x3400 [ 924.550168][T29386] ? __perf_event_task_sched_out+0x1127/0x1250 [ 924.556305][T29386] ? tun_do_read+0x1f10/0x1f10 [ 924.561043][T29386] ? __perf_event_task_sched_in+0x4ed/0x550 [ 924.566909][T29386] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 924.573467][T29386] ? __rcu_read_lock+0x50/0x50 [ 924.578200][T29386] ? find_next_bit+0xf7/0x120 [ 924.582847][T29386] ? finish_task_switch+0x2be/0x4c0 [ 924.588057][T29386] tun_chr_write_iter+0x121/0x1a0 [ 924.593124][T29386] __vfs_write+0x579/0x700 [ 924.597509][T29386] ? __kernel_write+0x340/0x340 [ 924.602337][T29386] ? pipe_wait+0x1c9/0x280 [ 924.606724][T29386] ? pipe_double_lock+0x1a0/0x1a0 [ 924.611730][T29386] __kernel_write+0x12c/0x340 [ 924.616393][T29386] write_pipe_buf+0x148/0x1d0 [ 924.621045][T29386] ? default_file_splice_write+0x240/0x240 [ 924.626919][T29386] __splice_from_pipe+0x2d3/0x870 [ 924.631923][T29386] ? default_file_splice_write+0x240/0x240 [ 924.637717][T29386] default_file_splice_write+0x179/0x240 [ 924.643328][T29386] ? default_file_splice_read+0x920/0x920 [ 924.649014][T29386] ? avc_policy_seqno+0x17/0x70 [ 924.653845][T29386] ? security_file_permission+0x128/0x300 [ 924.659540][T29386] ? default_file_splice_read+0x920/0x920 [ 924.665230][T29386] __se_sys_splice+0x860/0x1b90 [ 924.670054][T29386] ? security_file_permission+0x128/0x300 [ 924.675744][T29386] ? fput_many+0x42/0x1a0 [ 924.680044][T29386] ? ksys_write+0x237/0x2a0 [ 924.684564][T29386] ? __x64_sys_splice+0xf0/0xf0 [ 924.689421][T29386] ? __x64_sys_splice+0x1d/0xf0 [ 924.694279][T29386] do_syscall_64+0xcb/0x150 [ 924.698756][T29386] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 924.704619][T29386] RIP: 0033:0x45d5b9 [ 924.708482][T29386] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 924.728055][T29386] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 924.736430][T29386] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 22:55:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4000000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 924.744369][T29386] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 924.752307][T29386] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 924.760246][T29386] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000026 [ 924.768185][T29386] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:40 executing program 4: r0 = socket(0x840000000002, 0x3, 0xff) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) socket$inet_icmp_raw(0x2, 0x3, 0x1) connect$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(r0, &(0x7f0000003440)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)="f731881732ce16e36503a00304fbf20e867f9620d55c86ac309004", 0x1b}, {&(0x7f00000000c0)='|', 0x1}], 0x2}}], 0x1, 0x0) 22:55:40 executing program 0 (fault-call:12 fault-nth:39): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8c}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000007c0)=[{{&(0x7f0000000ac0)=@ax25={{0x3, @rose}, [@netrom, @netrom, @bcast, @bcast, @null, @default, @remote, @bcast]}, 0x80, &(0x7f0000000980)=[{0x0}, {0x0}, {&(0x7f0000000c40)=""/90, 0x5a}, {&(0x7f0000000580)=""/125, 0x7d}], 0x4, &(0x7f00000002c0)=""/56, 0x38}, 0x5}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000640)=""/146, 0x92}, {&(0x7f00000004c0)=""/118, 0x76}], 0x2, &(0x7f0000000340)=""/27, 0x1b}}, {{&(0x7f0000000700)=@x25={0x9, @remote}, 0x80, 0x0, 0x0, &(0x7f00000008c0)=""/112, 0x70}, 0x3}, {{0x0, 0x0, 0x0}}], 0x4, 0x22, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x2}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, &(0x7f0000000100)={0x0, 0x0, 0x7d, 0xfffffffffffffffc}) syz_genetlink_get_family_id$nl80211(&(0x7f0000003240)='nl80211\x00') sendmsg$NL80211_CMD_REQ_SET_REG(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f00000009c0)=ANY=[@ANYRESDEC, @ANYRES16=0x0, @ANYBLOB, @ANYBLOB="36d829791ad4b221a34b5172d9b9d393e43c8f5dd3dd8510fb0cb3299783bf0600363327b2b66a3efaf6777da0f4e9da0a04dfbd9dde00000000faed0ab327215967a74233f5e5f73b37b194cf8121b56f219ab391e769b718f39434211c9107b08fe2c1776c89dc52841fbc0b2f13bb5d85000000000000c96ce8f762eb72627ac367a0c55da96e3f14ed45c67f54780e05d4ba948fd37eac86fedd7ef0a28fba7486126516c35dccf01062e0484fe149cd963b7ead1ea3d2cccfa13cac0217d2559a84e4cabe1e26f2ac66eeb883ed08b04ede2598000000000037b0ca53a7f854234c7c1e"]}}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x1, 0x0, 0x0, 0x3, 0x100000000, 0x2000002, 0x0, 0x0, 0xe7}, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r4, &(0x7f0000000280)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000600)=0xda6, 0x4) writev(r4, &(0x7f0000000780)=[{&(0x7f0000000100)="dff548771d77ce8786aca76dda6fb054ab8ea73799d7293eda90ba41a2db81fab55b5415692300a8e64bca2f60e1717f85f06a6bbca90f392b04f34940db7ffccc33ed6ea82296de9683c9e360cd1c477304bd8f9bd74d44a4c7d1c7e625a86cd54b72c5745f475a772b84977a6b05381dbe6259bc510f0f70c3e9946a78c7b5a19e97447799d930f9623b", 0x8b}, {&(0x7f00000001c0)="96431fb1cb119741590ad657dc5e5ce3e5fe9f1f639e6a18bc7b6c1d0b424eb306f34cf2429c62c0fdefbae36740a7169721af852826d7f14b6cae8af86507ff78a1dda991aea5952f43e7e0146a3c035f0113d617240e8940c60cdf3400193bbe3a0c0b1eae5799db27b4ee9c13475210defa4dac9d784e0c89135b82b321f8e43d7a5db9ab1bfd319f472a94", 0x8d}, {&(0x7f0000001340)="f15c93cb35c215fe339d1e9060c5b23e77cb58a87329a00288504db389cc6e395885fa906ac30eeae99fa388c31b5717e641e1586a90961b5f99b26c939d944f6cb1cf6817b7e51402a8459f9db642e97d3c05db56250a665d3ff188eb47e5b036d508aa5a5796fb8806b6a41487e0bfc3df087c18269bd7d2f477104c5d5db497ceaf3e1b11a5d63a2b7035dc69fa701f3b46fe701880800a7d38dccd4b3e8014aa15c96968359533ce2c5ffdd5f0d3297018bd7c025150940cdead92eb1e6bc6ba45eecf067b32425b6000b2f376ef9172426ae7fa97e5a84ef4dc540bbf5dd458ffcb75724135bd32fa04db6d6a75aedda7ab6e8501fc94e209dc3b2525ae24c954255d3247ca9c1b9525ce68179a52a87333aa2b0a8c1baa6ba6160c6d2018e67bac5402d0d89c5f798b8d1a87b0dc3306f546c61724530d9f4b6f0ee68677c7b261de5afa02d708a8ec979791de8f4831cc354ba453bc253e2435207f25494a594d4e5be39902358d362cb318ad965b7e7480a5ca5b6fe74e101c400c77392ee4419ad788f494230487811046f21f0f9665dfbaa9e94ed305a02e3fa47039e67dde19f89c8f1741aad752cdfe458ddf54e8fc10ff79b5", 0x1b9}], 0x3) sendto$inet(r4, &(0x7f00000012c0)="1a268a927f1f6588b967481241ba78600453f65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x27) 22:55:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r5, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 925.303845][T29420] FAULT_INJECTION: forcing a failure. [ 925.303845][T29420] name failslab, interval 1, probability 0, space 0, times 0 [ 925.316563][T29420] CPU: 0 PID: 29420 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 925.326684][T29420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 925.336707][T29420] Call Trace: [ 925.340054][T29420] dump_stack+0x1b0/0x21e [ 925.344356][T29420] ? devkmsg_release+0x11c/0x11c [ 925.349313][T29420] ? show_regs_print_info+0x12/0x12 [ 925.354516][T29420] ? __rcu_read_lock+0x50/0x50 [ 925.359250][T29420] ? get_random_u32+0x112/0x210 [ 925.364070][T29420] ? kasan_init_slab_obj+0x20/0x30 [ 925.369151][T29420] should_fail+0x6fb/0x860 [ 925.373536][T29420] ? setup_fault_attr+0x2b0/0x2b0 [ 925.378529][T29420] ? setup_fault_attr+0x2b0/0x2b0 [ 925.383522][T29420] ? eth_get_headlen+0x240/0x240 [ 925.388431][T29420] ? tun_get_user+0xc08/0x3400 [ 925.393175][T29420] should_failslab+0x5/0x20 [ 925.397651][T29420] __kmalloc_track_caller+0x5d/0x2b0 [ 925.402908][T29420] ? __napi_alloc_skb+0xd6/0x520 [ 925.407817][T29420] ? tun_get_user+0xc08/0x3400 [ 925.412570][T29420] pskb_expand_head+0x10d/0xfb0 [ 925.417399][T29420] tun_get_user+0xc08/0x3400 [ 925.421958][T29420] ? tun_do_read+0x1f10/0x1f10 [ 925.426691][T29420] ? __perf_event_task_sched_in+0x4ed/0x550 [ 925.432550][T29420] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 925.438842][T29420] ? perf_pmu_sched_task+0x370/0x370 [ 925.444093][T29420] ? switch_mm_irqs_off+0x46e/0x870 [ 925.449260][T29420] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 925.455812][T29420] ? switch_mm+0xe0/0xe0 [ 925.460043][T29420] ? __rcu_read_lock+0x50/0x50 [ 925.464787][T29420] ? _raw_spin_unlock_irq+0x5/0x20 [ 925.469876][T29420] ? finish_task_switch+0x235/0x4c0 [ 925.475049][T29420] tun_chr_write_iter+0x121/0x1a0 [ 925.480045][T29420] __vfs_write+0x579/0x700 [ 925.484430][T29420] ? __kernel_write+0x340/0x340 [ 925.489251][T29420] ? __kernel_text_address+0x93/0x110 [ 925.494590][T29420] ? retint_kernel+0x1b/0x1b [ 925.499151][T29420] __kernel_write+0x12c/0x340 [ 925.503794][T29420] write_pipe_buf+0x148/0x1d0 [ 925.508455][T29420] ? default_file_splice_write+0x240/0x240 [ 925.514246][T29420] ? __rcu_read_lock+0x50/0x50 [ 925.518983][T29420] __splice_from_pipe+0x2d3/0x870 [ 925.523986][T29420] ? default_file_splice_write+0x240/0x240 [ 925.529762][T29420] default_file_splice_write+0x179/0x240 [ 925.535363][T29420] ? default_file_splice_read+0x920/0x920 [ 925.541050][T29420] ? avc_policy_seqno+0x17/0x70 [ 925.545872][T29420] ? security_file_permission+0x128/0x300 [ 925.551570][T29420] ? default_file_splice_read+0x920/0x920 [ 925.557268][T29420] __se_sys_splice+0x860/0x1b90 [ 925.562099][T29420] ? security_file_permission+0x128/0x300 [ 925.567790][T29420] ? fput_many+0x42/0x1a0 [ 925.572088][T29420] ? ksys_write+0x237/0x2a0 [ 925.576559][T29420] ? __x64_sys_splice+0xf0/0xf0 [ 925.581378][T29420] ? __x64_sys_splice+0x1d/0xf0 [ 925.586207][T29420] do_syscall_64+0xcb/0x150 [ 925.590677][T29420] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 925.596536][T29420] RIP: 0033:0x45d5b9 [ 925.600399][T29420] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 925.619984][T29420] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 925.628369][T29420] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 925.636310][T29420] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 925.644256][T29420] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 925.652198][T29420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000027 [ 925.660148][T29420] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4002000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:40 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 0 (fault-call:12 fault-nth:40): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 4: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 926.149851][T29459] FAULT_INJECTION: forcing a failure. [ 926.149851][T29459] name failslab, interval 1, probability 0, space 0, times 0 [ 926.162485][T29459] CPU: 1 PID: 29459 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 926.172609][T29459] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 926.182635][T29459] Call Trace: [ 926.185962][T29459] dump_stack+0x1b0/0x21e [ 926.190263][T29459] ? devkmsg_release+0x11c/0x11c [ 926.195170][T29459] ? ktime_get_with_offset+0x186/0x1c0 [ 926.200596][T29459] ? show_regs_print_info+0x12/0x12 [ 926.205762][T29459] ? netif_receive_skb_list_internal+0x46a/0x720 [ 926.212068][T29459] should_fail+0x6fb/0x860 [ 926.216457][T29459] ? setup_fault_attr+0x2b0/0x2b0 [ 926.221455][T29459] ? eth_get_headlen+0x240/0x240 [ 926.226385][T29459] ? iov_iter_advance+0x707/0xee0 [ 926.231391][T29459] ? __napi_alloc_skb+0xd6/0x520 [ 926.236301][T29459] should_failslab+0x5/0x20 [ 926.240775][T29459] kmem_cache_alloc+0x36/0x250 [ 926.245513][T29459] __napi_alloc_skb+0xd6/0x520 [ 926.250243][T29459] napi_get_frags+0x5c/0x100 [ 926.254801][T29459] tun_get_user+0x9ce/0x3400 [ 926.259372][T29459] ? __rcu_read_lock+0x50/0x50 [ 926.264123][T29459] ? __perf_event_task_sched_out+0x1127/0x1250 [ 926.270252][T29459] ? tun_do_read+0x1f10/0x1f10 [ 926.274993][T29459] ? __perf_event_task_sched_in+0x4ed/0x550 [ 926.280942][T29459] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 926.287497][T29459] ? __rcu_read_lock+0x50/0x50 [ 926.292275][T29459] ? find_next_bit+0xf7/0x120 [ 926.296919][T29459] ? finish_task_switch+0x2be/0x4c0 [ 926.302083][T29459] tun_chr_write_iter+0x121/0x1a0 [ 926.307082][T29459] __vfs_write+0x579/0x700 [ 926.311501][T29459] ? __kernel_write+0x340/0x340 [ 926.316320][T29459] ? mutex_lock+0xa6/0x110 [ 926.320722][T29459] ? pipe_wait+0x1c9/0x280 [ 926.325131][T29459] ? pipe_double_lock+0x1a0/0x1a0 [ 926.330130][T29459] __kernel_write+0x12c/0x340 [ 926.334777][T29459] write_pipe_buf+0x148/0x1d0 [ 926.339426][T29459] ? splice_from_pipe_next+0x40e/0x440 [ 926.344859][T29459] ? default_file_splice_write+0x240/0x240 [ 926.350641][T29459] __splice_from_pipe+0x2d3/0x870 [ 926.355635][T29459] ? default_file_splice_write+0x240/0x240 [ 926.361412][T29459] default_file_splice_write+0x179/0x240 [ 926.367035][T29459] ? default_file_splice_read+0x920/0x920 [ 926.372722][T29459] ? avc_policy_seqno+0x17/0x70 [ 926.377544][T29459] ? security_file_permission+0x128/0x300 [ 926.383229][T29459] ? default_file_splice_read+0x920/0x920 [ 926.388916][T29459] __se_sys_splice+0x860/0x1b90 [ 926.393744][T29459] ? security_file_permission+0x128/0x300 [ 926.399453][T29459] ? fput_many+0x42/0x1a0 [ 926.403765][T29459] ? ksys_write+0x237/0x2a0 [ 926.408251][T29459] ? __x64_sys_splice+0xf0/0xf0 [ 926.413071][T29459] ? __x64_sys_splice+0x1d/0xf0 [ 926.417898][T29459] do_syscall_64+0xcb/0x150 [ 926.422376][T29459] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 926.428238][T29459] RIP: 0033:0x45d5b9 [ 926.432203][T29459] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 926.451775][T29459] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 926.460156][T29459] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 926.468097][T29459] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 926.476042][T29459] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 926.483993][T29459] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000028 [ 926.492131][T29459] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4102000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:41 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x5ac, 0x24e, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000400)={'veth1_to_batadv\x00', 0x3400}) syz_usb_control_io(r1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) ioctl$F2FS_IOC_GET_PIN_FILE(r2, 0x8004f50e, &(0x7f00000003c0)) syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x0, 0x17ef, 0x6049, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x80, 0x70, 0x7f, [{{0x9, 0x4, 0x0, 0x4, 0x1, 0x3, 0x1, 0x3, 0x80, {0x9, 0x21, 0xfffa, 0xef, 0x1, {0x22, 0x901}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0x7, 0x6}}}}}]}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x9, 0xfc, 0x8, 0x50, 0x3}, 0x12, &(0x7f0000000100)={0x5, 0xf, 0x12, 0x2, [@ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x2, 0x7, 0x4, 0x6}]}, 0x4, [{0xd4, &(0x7f0000000200)=@string={0xd4, 0x3, "d60f86aaf6cc34b393b4758a796d2e844294a0776f8f9ec71c2040fa9b00e9455e4e9af38f6477bf61c8eb1a20c1eb05feb3bee3ae0d82137f46860eba8105cd45ea4f034491a475055c85f08998c3bfaafec1fc532460f6e0597bc2ff08f231426475e0abad1d63a8963d280ed6e49e05ce9c38300552061cd63dd0f8ff2af042a640319e8253d5b18ca0ebd5b8de788f9656747d6c7347b1d63cc5c7afee36b3884466dd021f5760be78a8ac47faf66426c6a244c901f90f2bb653cfa9043bad3a583860978069b11051c9066e2dcbb567"}}, {0x22, &(0x7f0000000140)=@string={0x22, 0x3, "37af13fc886a1771a21d87f6b10e897b1a40f16b3e280a7b4e25d713fcf72abc"}}, {0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x459}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x407}}]}) syz_usb_control_io$cdc_ecm(r1, &(0x7f00000001c0)={0x14, &(0x7f00000000c0)={0x0, 0x0, 0x5, {0x5, 0x0, "81b663"}}, 0x0}, 0x0) 22:55:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000140)={@remote, 0x4, 0x0, 0x0, 0x8, 0x4, 0x8}, &(0x7f0000000180)=0x20) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:41 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:41 executing program 0 (fault-call:12 fault-nth:41): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:41 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 926.946291][ T4047] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 927.018864][T29488] FAULT_INJECTION: forcing a failure. [ 927.018864][T29488] name failslab, interval 1, probability 0, space 0, times 0 [ 927.031488][T29488] CPU: 1 PID: 29488 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 927.041613][T29488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 927.051692][T29488] Call Trace: [ 927.054953][T29488] dump_stack+0x1b0/0x21e [ 927.059256][T29488] ? devkmsg_release+0x11c/0x11c [ 927.064210][T29488] ? ktime_get_with_offset+0x186/0x1c0 [ 927.069636][T29488] ? show_regs_print_info+0x12/0x12 [ 927.074828][T29488] should_fail+0x6fb/0x860 [ 927.079212][T29488] ? setup_fault_attr+0x2b0/0x2b0 [ 927.084204][T29488] ? iov_iter_advance+0x707/0xee0 [ 927.089196][T29488] ? __napi_alloc_skb+0xd6/0x520 [ 927.094102][T29488] should_failslab+0x5/0x20 [ 927.098577][T29488] kmem_cache_alloc+0x36/0x250 [ 927.103311][T29488] __napi_alloc_skb+0xd6/0x520 [ 927.108046][T29488] napi_get_frags+0x5c/0x100 [ 927.112603][T29488] tun_get_user+0x9ce/0x3400 [ 927.117162][T29488] ? ttwu_do_wakeup+0x154/0x5b0 [ 927.122002][T29488] ? trace_event_raw_event_rcu_utilization+0x170/0x170 [ 927.128825][T29488] ? rcu_note_context_switch+0x1052/0x1170 [ 927.134597][T29488] ? tun_do_read+0x1f10/0x1f10 [ 927.139329][T29488] ? __rcu_read_lock+0x50/0x50 [ 927.144065][T29488] ? __cgroup_account_cputime+0x2ba/0x2e0 [ 927.149750][T29488] ? update_curr+0x584/0x740 [ 927.154306][T29488] ? __rcu_read_lock+0x50/0x50 [ 927.159036][T29488] tun_chr_write_iter+0x121/0x1a0 [ 927.164031][T29488] __vfs_write+0x579/0x700 [ 927.168436][T29488] ? __kernel_write+0x340/0x340 [ 927.173257][T29488] ? mutex_lock+0xa6/0x110 [ 927.177653][T29488] ? ___preempt_schedule+0x16/0x20 [ 927.182732][T29488] ? pipe_wait+0x1c9/0x280 [ 927.187137][T29488] ? pipe_double_lock+0x1a0/0x1a0 [ 927.192135][T29488] __kernel_write+0x12c/0x340 [ 927.196784][T29488] write_pipe_buf+0x148/0x1d0 [ 927.201431][T29488] ? splice_from_pipe_next+0x40e/0x440 [ 927.206860][T29488] ? default_file_splice_write+0x240/0x240 [ 927.212633][T29488] __splice_from_pipe+0x2d3/0x870 [ 927.217643][T29488] ? default_file_splice_write+0x240/0x240 [ 927.223414][T29488] default_file_splice_write+0x179/0x240 [ 927.229026][T29488] ? default_file_splice_read+0x920/0x920 [ 927.234711][T29488] ? avc_policy_seqno+0x17/0x70 [ 927.239532][T29488] ? security_file_permission+0x128/0x300 [ 927.245233][T29488] ? default_file_splice_read+0x920/0x920 [ 927.250933][T29488] __se_sys_splice+0x860/0x1b90 [ 927.255763][T29488] ? security_file_permission+0x128/0x300 [ 927.261480][T29488] ? fput_many+0x42/0x1a0 [ 927.265807][T29488] ? ksys_write+0x237/0x2a0 [ 927.270276][T29488] ? __x64_sys_splice+0xf0/0xf0 [ 927.275095][T29488] ? __x64_sys_splice+0x1d/0xf0 [ 927.279915][T29488] do_syscall_64+0xcb/0x150 [ 927.284391][T29488] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 927.290258][T29488] RIP: 0033:0x45d5b9 [ 927.294138][T29488] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:55:42 executing program 3: r0 = socket(0x11, 0x800000003, 0x0) bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r1}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 927.313722][T29488] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 927.322108][T29488] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 927.330050][T29488] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 927.337990][T29488] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 927.345929][T29488] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000029 [ 927.353872][T29488] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:42 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4200000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:42 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 927.616343][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 927.628167][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 927.641101][ T4047] usb 5-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 927.650472][ T4047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.659334][ T4047] usb 5-1: config 0 descriptor?? [ 928.006276][ T4047] usbhid 5-1:0.0: can't add hid device: -71 [ 928.012248][ T4047] usbhid: probe of 5-1:0.0 failed with error -71 [ 928.020206][ T4047] usb 5-1: USB disconnect, device number 63 [ 928.506218][ T4047] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 928.866253][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 928.877123][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 928.886989][ T4047] usb 5-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 928.895989][ T4047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 928.904669][ T4047] usb 5-1: config 0 descriptor?? [ 929.356854][T29471] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 929.376924][ T4047] apple 0003:05AC:024E.0038: item fetching failed at offset 4/5 [ 929.384631][ T4047] apple 0003:05AC:024E.0038: parse failed [ 929.391662][ T4047] apple: probe of 0003:05AC:024E.0038 failed with error -22 [ 929.577232][ T4047] usb 5-1: USB disconnect, device number 64 [ 930.346162][ T4047] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 930.706179][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 930.717061][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 930.726805][ T4047] usb 5-1: New USB device found, idVendor=05ac, idProduct=024e, bcdDevice= 0.40 [ 930.735810][ T4047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 930.744530][ T4047] usb 5-1: config 0 descriptor?? 22:55:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:45 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4800000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:45 executing program 3: r0 = socket$inet6(0xa, 0x0, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:45 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x3, 0x0, 0x0, 0x8, 0x8000000000000, 0x0, 0x7ff, 0x4, 0x6}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000002080)=[{{0x0, 0x0, &(0x7f0000001b00)=[{0x0}, {&(0x7f0000000880)=""/167, 0xa7}, {&(0x7f0000000940)=""/137, 0x89}, {&(0x7f0000000a00)=""/4096, 0x1000}], 0x4, &(0x7f00000002c0)=""/26, 0x1a}}, {{&(0x7f0000001a80)=@l2tp6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000001e40)=""/199, 0xc7}, 0x2}, {{&(0x7f0000001f40)=@tipc=@id, 0x80, 0x0}, 0x1}, {{&(0x7f0000000340)=@phonet, 0x80, &(0x7f00000006c0)=[{&(0x7f0000001b80)=""/222, 0xde}, {&(0x7f0000000180)=""/3, 0x3}, {&(0x7f0000001c80)=""/155, 0x9b}, {&(0x7f0000001d40)=""/244, 0xf4}], 0x4, &(0x7f0000001fc0)=""/187, 0xbb}, 0x400}], 0x4, 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'veth1_macvtap\x00'}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x200, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x3ff, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000040), 0x7}, 0x0, 0x1f, 0x2}, 0x0, 0xffffffffffffffff, r4, 0x0) ioctl$TIOCSBRK(r2, 0x5427) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x5}, 0x800, 0x0, 0x0, 0x0, 0x0, 0x800, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/partitions\x00', 0x0, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETGROUP(r3, 0x400454ce, 0xffffffffffffffff) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 22:55:45 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:45 executing program 0 (fault-call:12 fault-nth:42): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:45 executing program 3: r0 = socket$inet6(0xa, 0x0, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:45 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 930.966131][ T4047] usbhid 5-1:0.0: can't add hid device: -71 [ 930.972156][ T4047] usbhid: probe of 5-1:0.0 failed with error -71 [ 930.980393][ T4047] usb 5-1: USB disconnect, device number 65 [ 930.995538][T29531] FAULT_INJECTION: forcing a failure. [ 930.995538][T29531] name failslab, interval 1, probability 0, space 0, times 0 [ 931.008168][T29531] CPU: 0 PID: 29531 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 931.018301][T29531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 931.028343][T29531] Call Trace: [ 931.031624][T29531] dump_stack+0x1b0/0x21e [ 931.035935][T29531] ? devkmsg_release+0x11c/0x11c [ 931.040859][T29531] ? ktime_get_with_offset+0x186/0x1c0 [ 931.046290][T29531] ? show_regs_print_info+0x12/0x12 [ 931.051456][T29531] should_fail+0x6fb/0x860 [ 931.055841][T29531] ? setup_fault_attr+0x2b0/0x2b0 [ 931.060834][T29531] ? eth_get_headlen+0x240/0x240 [ 931.065783][T29531] ? iov_iter_advance+0x707/0xee0 [ 931.070782][T29531] ? __napi_alloc_skb+0xd6/0x520 [ 931.075694][T29531] should_failslab+0x5/0x20 [ 931.080168][T29531] kmem_cache_alloc+0x36/0x250 [ 931.084908][T29531] __napi_alloc_skb+0xd6/0x520 [ 931.089644][T29531] napi_get_frags+0x5c/0x100 [ 931.094205][T29531] tun_get_user+0x9ce/0x3400 [ 931.098783][T29531] ? trace_event_raw_event_rcu_utilization+0x170/0x170 [ 931.105609][T29531] ? rcu_note_context_switch+0x1052/0x1170 [ 931.111388][T29531] ? tun_do_read+0x1f10/0x1f10 [ 931.116124][T29531] ? __rcu_read_lock+0x50/0x50 [ 931.120857][T29531] ? __cgroup_account_cputime+0x2ba/0x2e0 [ 931.126545][T29531] ? update_curr+0x584/0x740 [ 931.131103][T29531] ? __rcu_read_lock+0x50/0x50 [ 931.135846][T29531] tun_chr_write_iter+0x121/0x1a0 [ 931.140849][T29531] __vfs_write+0x579/0x700 [ 931.145232][T29531] ? __kernel_write+0x340/0x340 [ 931.150053][T29531] ? pipe_wait+0x1c9/0x280 [ 931.154446][T29531] ? pipe_double_lock+0x1a0/0x1a0 [ 931.159441][T29531] __kernel_write+0x12c/0x340 [ 931.164098][T29531] write_pipe_buf+0x148/0x1d0 [ 931.168755][T29531] ? splice_from_pipe_next+0x40e/0x440 [ 931.174196][T29531] ? default_file_splice_write+0x240/0x240 [ 931.179974][T29531] ? anon_pipe_buf_release+0x167/0x1c0 [ 931.185400][T29531] __splice_from_pipe+0x2d3/0x870 [ 931.190406][T29531] ? default_file_splice_write+0x240/0x240 [ 931.196180][T29531] default_file_splice_write+0x179/0x240 [ 931.201777][T29531] ? default_file_splice_read+0x920/0x920 [ 931.207464][T29531] ? avc_policy_seqno+0x17/0x70 [ 931.212286][T29531] ? security_file_permission+0x128/0x300 [ 931.217987][T29531] ? default_file_splice_read+0x920/0x920 [ 931.223672][T29531] __se_sys_splice+0x860/0x1b90 [ 931.228493][T29531] ? security_file_permission+0x128/0x300 [ 931.234203][T29531] ? fput_many+0x42/0x1a0 [ 931.238500][T29531] ? ksys_write+0x237/0x2a0 [ 931.242986][T29531] ? __x64_sys_splice+0xf0/0xf0 [ 931.247806][T29531] ? __x64_sys_splice+0x1d/0xf0 [ 931.252623][T29531] do_syscall_64+0xcb/0x150 [ 931.257096][T29531] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 931.262954][T29531] RIP: 0033:0x45d5b9 [ 931.266821][T29531] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 931.286393][T29531] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 931.294770][T29531] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 931.302721][T29531] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x0, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 931.310755][T29531] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 931.318698][T29531] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002a [ 931.326642][T29531] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88002, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x420000015001}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @empty}}) pipe(&(0x7f0000000300)={0xffffffffffffffff}) keyctl$get_keyring_id(0x0, 0x0, 0xad) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCL_SELLOADLUT(r2, 0x541c, &(0x7f0000000040)={0x5, 0xae, 0x6617, 0x80, 0x10000}) write$tun(r0, &(0x7f0000000100)={@void, @val={0x0, 0x0, 0x14}, @mpls={[], @ipv4=@gre={{0x5, 0x4, 0x0, 0x0, 0xfc0, 0x0, 0x0, 0x0, 0x2f, 0x0, @dev, @empty=0xffffffff}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x1, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57}, {}, {0x8, 0x88be, 0x0, {{}, 0x5700}}, {0x2c}, {0x8, 0x6558, 0x0, "4b694be8c1b98adb8d6e88205f33cd8c58231293e0cebdea3eb92130feb761b93cba1d917f0b6bff5cda111631215c3695417f3b1fc134d2eabce5952ec16be421353fc463cf517a42ba1d1dea78912c68559bf32e5921a8d6f849e146f3d814ff8ea1488a6c5a8dca4c0bb5a5805df15e9637560ba748bca5f0a23beb426e188924f144c4124e317061e6d08d4998a61bc3270019fc6bb78aff172d1b311bddced44d1409b3c282ba59171d1fa9ae2ec63aea543f4d399b4f6c235ed315e4326a247700b29a532e83690eb3911d73f8f03f4111b83ea19d6f93a48ec0d2401fa63b9b94bac962fd8c80001e3b8b703f74fb34873d03a3860b4f2780392ebb02a3620921a973cb5ca02d3003d8fd673ca25db503a78853ea976859858a6a4a5e9e144819661db3b0551e11340dc6b755b4cdf7b4df0b948109bb9a9d7b1ff585bb43ec74077085105752776f5d7a477743bb040e320765d33449d1df17dec0407e7fbc07a035b26ccd4f2f16aaeecff53c73dd4ac49f2f061f67889e04297daed05a6a2e2d4c58a0b99d1afc5d9c7add9b117d7786c8c4fc8909c67ad3605d1a9c6c4a97bb0162048146c373060f8538ddd074212cbfde1896512d46fa2724ac76fd1f5978c32f50c3b2c567e0dd88892c84856d3d964bcd05be0bf13a6f9c49eef61c31a54ceee5e6c8e2a4cb5ac294589f1efd387567c5906236a656f1a9836ba4da332e5137dd4398652dbcbbffe2afeffa3143726a8129a8c032b85150c13ac8f99f56cc4ed41f5ec56590e9d5c84510167f28d32db2a4e7450265a868d099b37d8ad6f6c381435769d2c573422cfb2e6ced643f0f8607df01805cfc9992e18fa4c6c8bce2f341bd6a3013e56a186491129dd65d1ff125ef7f2dcd0ca70cb059045d56309e8ce0307dbac0616013ef50968aef621f425c9f3348bdc9809c13dad6e047d74207b7a627b1f2658cc66f376078f0dca939fccb280a67df2485c67e19ff8e874da964a106d3c658198342ae542b01c07fd44066edb1a94ef611ad1dc94a808cc8bc2fec8f993ad315b80d15f6362d110479e5fdf5fed5e6379169a6b327b0faf8211ea880554f051f70bd55f8198067ed874a67f73943a0ed6a0626efaccb96a0edea375c514f2b4a41007bd9b1def76abe67c4ec8538d1087c04e0a4d0498bd1ba32a406818ed5e7dcccce3aba8d7a7ccfd06ad8a2008075e68f04501561309cafb337e2d97dc4383bef96924c4e1ba67a5b9b43f49a5e43092dacaa78bb890e751037238cf385625cd9a70ee468eab2a8477bcdf9dab5e71c57dcc49efa75727694d40e91c30440c45817e908e8adab775088863f8fb2a60b452c3f00ada34877882be2d3f837d460f8a4c9de9ebe8d6c11ed3f0bfd4306eadeaddd8277596139725b624a4e242c91232b954f12448951c6f56662f998edb22557adb237901585c0a871fc0d5b1e1462ddc7e0e68f138e724cee7b7d74b1966eddaf71ddafb8b13910ced717cc2a1aee8b942d431763a5acf62896c0ec7538371cac7ffecddd50864a68b7e0fb65611b22dedc46b051611d684b5d7338595380a601680cc558c0673698955d006225d689369388cbb2c558736a9a2bce867204e936e9199defc6d82001d3de70278919442cd34be83bb25c553a88345c56fc0f5631e5db2c6cf500b04e926c1de2e24bc3c929de0afb795596546b8d5c972153fcddb1c5cba0ed34bab89924facb0a9c58c9155ecd946e660758b0dfa04384b9fd011f0e3d4a6e9c8fa7ff6c5d57f63a7437cde4979bbdd8a6a32013cfc03f6cf90bdc27554b40f8eda758c8865e5dea86d09e8fe1c91251e9b2d9dc31e0e5937bdc56673339782f7920b4d397f7f345c308b1315d84f91827c178260dddd837b8d614ba0bd492913b8f6369d6a4824e2e53da910247c34e7c483d9d178ccf07cf4a8fd73fd170099dbe9a6292a816a979c082d0fa4ca2275e6fdc364b6a684bc536022929b99cfdb4c4bac6760f86eedd9b14e0835c578ac5a639a5e7ec2b6abe15755e1da36d5763d7c85e1c3822ca4911be5f58fb3c60d8524f13e20372e79bd92b5a7ab9afb13770d230c69787b7e6492ccd6c45fb8877af53f76803f9b746d1849f6c42a4a68a944c3542fc1d2cc7e2690ac1e592ea6a8882b5537aaed2ff133143560d3091e7376625549318575501f489d2cc9cc87e2d360b6e91a48a2a867d41d859523d33bcab10b192d8895d597a14f59f4a656f841df8da81d5a02245800a9296f7547b72109c529f0103cc07e859435d9a88f89e89fb5788cadafbe18b6ba688076cbf795699bc2cefaccfaf311eeace44bdf7193c0e132917f459ea9d3289ab86b2f63686a8606559f4e0f3791a8dce6693264b85a73bae47a39b5d99e2bed4e2a2f27c86350b49084e489a5c25af7ec0d6a2c14a00b770b9c9ccb21e84b8186272f96eb04f7507d9fb1e2e61f70c4012221cd29ba0b6399b70eecf62cabd321e1c894b8dc31ef21c3ee3191d6dda1f9ffae012c9a88c3e0c745dacbd9576b7e54338fdf49f9736c5719c28f13b3ed063c6e653c5c2bd75e7153507c6bf2abf015681185130d6792efc533fe54bd647c05996e49c4b53354cd58a7c68b75e633cd90d6ef17b4fd0bc49d8ef2918a6506f9ef79b86df5d920bfa0ea92f3ea48356883050660f5ab47250aa99706d35b8daf11f98558779a1bf6a882516655862febdddacedd406076edafd0a1cfab782c3ad746f5c9486389c11caf4ad85ee2060a22389b45c4cbefd75f675ee9c2981225fea301a9ec1da50d798d8729bf71f885e943c23dda9ce1a33894f8318d05a40c1e2d5a4fbb9de539f3120588ab0a93ec6e7d69911af3c27790b03b0e62615bce3c3c3f075b04a5cda5358783a10477603d1a970e6e1af0956861c0c1591b317be968710d7a2091d604bc7826bf5ed829b36b8838c5a442dcd5e61d4320426477805d410ba33d03075cdd8de528e7aed4aeee31ade48716213b8f487299df14da6628f2444f5fda3bb5d0a327f25d6e256d65ec1da7275e960fc0233020b404cd5b5665cd5a0ff3e9dd727db48c687f60eadcaa80719522b1cc403390b05a3c86d41fba4c856dba891207e14af91afd63e1f840caf33873b6919b34df1e289a95841ac850be41698f95782e1952531ede1d940c9d6cab0861f87caf65d6a3bdd7f78d14b3706c0c2741d27810cc3560d37f8697e056112d23392ab3be659173c64116d7ed5c0f7e0c2d7a5e56fba09b7ae604af8fcbeb898a575b07e28b8d11d18c41ca927579a78d609a4a0c52ef325112d46d686de7c053c8fadbe8fac07109e6ed25939c5f6b51b9dc12b92652343d1c493972fac4f0e138fea46b9712d75ce5db78ca61d54e5bfc0758afee0833486a3562ebb7bba6f3fe44e467150899dc8aa9c207e4f5a8a1f68c2c25dc10c97cded0796324ecffb92ddbc73b19087e18df24a16fc3d6528b6992dba986f417cd5dc3276f398122581814996bbff004dcddaa66369413f824a1248f1f2743912d9a9a8bbe0c057664293c7ef174eff220c7a2fc842788a1b0f459e2f4fc068f8ba2b65a5513f759bbf7e3a22398f870482a655fd053dfd249c2740302906b9ba5feec6c9ca94be6dd738c6420ef0dc68a2df7ae8bad60e90317de84c7548402fb255e7f953f572cd02258cbc711f6eb508e7d1429064311c375de8386f38eacef77507e40876ed70c11f4ea752a721060694b5084879092a626c07245700e7304777ce9e6d5526ab6bdbcd8a1bb1f842ca0db42dd1c5991bba0666ba3b5fd224d3812d287bc27d27e9803cf5c68309859ca1fdc2c9037e44c96bbc0e012c7dd2cf700c295e6e9f79e0aa20565789bde8df6400776cf03cce828bb3c9bc92e257242b9b80d6de2ba07e4d454afd33c10ec83f057d5cdffff43d6a6e10b69e440ecfd72336e294a3a6e0127ea935f288d63ab5d02dfb2ce806bb3e93e9b3e865c62406b204318d79673d50753113b3af12fb0c74d2ade02cb7c4591a5b673fdebe41e3a850b36a5d2e17fb7445b6b125c0a784a01f0014b8e6eb2aa79980c825a5ae7166d6a3a33665aee298ce9186754fe065f3dca40056b0476604bd615b5fd066518cb1c60112af9f12eb2fdd281e00f46320f6f508cefdb40f7c92b80fd7096f10e33a0c4ecbd5aa67c4f66643707092a6da66ed717899c5aaaccf5aeac6db492f392d6e191192d3b4b2757f2ea24b3087fcb346b3545e3a55351f37dbbd438c3593bcf3275f7bb2d0d1251a452faa01c04c19d030694a08400fa30c09ca8efcd0d638cb2bdb92d1fade20a03e80d1011aed207347bd59400dcd1719776f5eb26d2cc3c60e52698705d44ee9b43633a0ca6a1c45710fc479864267a64cc589bba3c7549305476f4a8c4931a96761eb3870acebc83d866c74b52bc3051faadfec0d2af15e75af7864264ce02807ccaf4b036f6b14a0c7d38def12c1d44b40d43da62ebd70636d2de80ea813ae3dc302afe13a4688d591432c885e61771e58d155dc5c74ec67d6d02241ccedb227c5dff04052749e3e6a0232939f332e511267e69a8ae3dddbe239b81351fe767cf1cd6fff3881a6774473fedbd90976675fe9c2fe256a086d5ebf3a08e050d0301d8750406364828c421a81198b0d85ec6a032b2ee8c8dc4e5853ca4536d626168e6730fa929f3b4a70a4fd8d08df4c1e104f420d434c8e12c19d03616425a0d65f4ec3b2e499b402dcd4f43bcf90e1cb0b5a5f3b4b40fb70118d11bfd03f9b675b8ec8c121243392fa84dab99cffd0ee7531c35ba68e806be4667ff35f60b68ef5e595bc3b261e467c6bb6f80f00c98ecdf1b6fe07a1f88d08042402212575845e3ce0b179dc9e9d1a3187036910538cfb05e55831edb1e604a93fa1cd15129cde0056f5fb5d88a44dc2fac9da4cb5e0cc73505617f517d5a319e5ca6131baa3a0f2ccd9772fe3348b299fbcd0b359d54c581ffbb0ff82b827e486ea0bb6329567544ce3f51a73d66a13cfb69b9960a7398c98347b70b34d62ed81460ff251f55dfda90595d63a54e71dfd771491c0edf1d897692700b94ddc4458af03880eee6940d63fc08a00e270fcf239809b005e1aec84566ed7c0147d8fa5c661e9d610760c1bac551b7164ba1ace2162dd4966f5585e9ef9ed500e24cc7eb8d93d3d50bf764cb07b1ad63dc424744c0a79d725eda752c280013470af04718a47f8b4ffc16ebb201a4d120751828a666ac7723b0e19e0a8050ce1e50d65bdd0351378b57834769244fa2b3853785e6b65d334bd7cca0e80e759d3381db2e847a9035482901876c0c22c96dea93008f78c367dfb78dd99fb97e7925062743748d07ef01dd7fc39594239d514fc546ce44b82d48b67bc30a957e18149a78d549ca44dc025862acdeba81aae1d509480217a3d43635d439733e973b11c8d9f314f768b0db2bb61d7d0ebce78fdc0db1f32b979ef6dd82c3ffca9c9f85fa2ab04d28950cc1de66a2de7bbf064022effa830d3e6d64014a13b03743169cab7855f04f789f4d7cd2553f03e3537c0b322598798265b4ea001"}}}}}, 0xfca) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 931.546696][T29566] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:46 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x5900000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0x0) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:46 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:46 executing program 0 (fault-call:12 fault-nth:43): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x0, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x0, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x0, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:46 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x0, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 931.835218][T29581] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 931.875539][T29595] FAULT_INJECTION: forcing a failure. [ 931.875539][T29595] name failslab, interval 1, probability 0, space 0, times 0 [ 931.888194][T29595] CPU: 1 PID: 29595 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 931.898318][T29595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 931.908343][T29595] Call Trace: [ 931.911608][T29595] dump_stack+0x1b0/0x21e [ 931.915910][T29595] ? devkmsg_release+0x11c/0x11c [ 931.920820][T29595] ? ktime_get_with_offset+0x186/0x1c0 [ 931.926246][T29595] ? show_regs_print_info+0x12/0x12 [ 931.931419][T29595] ? netif_receive_skb_list_internal+0x46a/0x720 [ 931.937713][T29595] should_fail+0x6fb/0x860 [ 931.942102][T29595] ? setup_fault_attr+0x2b0/0x2b0 [ 931.947101][T29595] ? eth_get_headlen+0x240/0x240 [ 931.952034][T29595] ? iov_iter_advance+0x707/0xee0 [ 931.957034][T29595] ? __napi_alloc_skb+0xd6/0x520 [ 931.961938][T29595] should_failslab+0x5/0x20 [ 931.966411][T29595] kmem_cache_alloc+0x36/0x250 [ 931.971151][T29595] __napi_alloc_skb+0xd6/0x520 [ 931.975896][T29595] napi_get_frags+0x5c/0x100 [ 931.980455][T29595] tun_get_user+0x9ce/0x3400 [ 931.985065][T29595] ? __perf_event_task_sched_out+0x1127/0x1250 [ 931.991204][T29595] ? tun_do_read+0x1f10/0x1f10 [ 931.995985][T29595] ? __perf_event_task_sched_in+0x4ed/0x550 [ 932.001866][T29595] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 932.008445][T29595] ? __rcu_read_lock+0x50/0x50 [ 932.013193][T29595] ? find_next_bit+0xf7/0x120 [ 932.017852][T29595] ? finish_task_switch+0x2be/0x4c0 [ 932.023049][T29595] tun_chr_write_iter+0x121/0x1a0 [ 932.028047][T29595] __vfs_write+0x579/0x700 [ 932.032439][T29595] ? __kernel_write+0x340/0x340 [ 932.037263][T29595] ? pipe_wait+0x1c9/0x280 [ 932.041651][T29595] ? pipe_double_lock+0x1a0/0x1a0 [ 932.046644][T29595] __kernel_write+0x12c/0x340 [ 932.051290][T29595] write_pipe_buf+0x148/0x1d0 [ 932.055933][T29595] ? splice_from_pipe_next+0x40e/0x440 [ 932.061358][T29595] ? default_file_splice_write+0x240/0x240 [ 932.067138][T29595] ? anon_pipe_buf_release+0x167/0x1c0 [ 932.072573][T29595] __splice_from_pipe+0x2d3/0x870 [ 932.077577][T29595] ? default_file_splice_write+0x240/0x240 [ 932.083401][T29595] default_file_splice_write+0x179/0x240 [ 932.089027][T29595] ? default_file_splice_read+0x920/0x920 [ 932.094720][T29595] ? avc_policy_seqno+0x17/0x70 [ 932.099537][T29595] ? security_file_permission+0x128/0x300 [ 932.105225][T29595] ? default_file_splice_read+0x920/0x920 [ 932.110917][T29595] __se_sys_splice+0x860/0x1b90 [ 932.115746][T29595] ? security_file_permission+0x128/0x300 [ 932.121431][T29595] ? fput_many+0x42/0x1a0 [ 932.125731][T29595] ? ksys_write+0x237/0x2a0 [ 932.130201][T29595] ? __x64_sys_splice+0xf0/0xf0 [ 932.135024][T29595] ? __x64_sys_splice+0x1d/0xf0 [ 932.139848][T29595] do_syscall_64+0xcb/0x150 [ 932.144322][T29595] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 932.150182][T29595] RIP: 0033:0x45d5b9 [ 932.154043][T29595] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 932.173618][T29595] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 932.181997][T29595] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 932.189936][T29595] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 932.197878][T29595] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 932.205833][T29595] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002b [ 932.213771][T29595] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:47 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x4800000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x0, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:47 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x6801000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x0, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 932.481934][T29600] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:47 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:47 executing program 4: syz_read_part_table(0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000180)="020181000fff0a000000ff45ac04800000006300e931190000000000000680170003550000000a0000008777007200300700a5ffffff000000ed690000cb55aa", 0x40, 0x1c0}, {&(0x7f00000001c0)="2fe66dfef882fc19f45ed6eaf8191a9e5f157581972a4f82b31493419d3630373a5c5b054f9ecfc66ab532800ae337622bbc7959637eaab2777ff8cd7ffab2805e205a07e33cd9d4d454b401f07384567a6d756cd97bccd66369dc27312fb8941520b974d318a47df86a219b5df7d7b7d34377ffc45f9f9853afcca26dc05ee205acb95a5ed1f0f57d370354f82c9959abc9837561663f54760f6a5fc9a0f9df44e7c6596a02907e6151221d6bdbca714245eba0ac66fe3c08a990d0628822d5d2ca3fef083b23c2f953250b21b6902359714bec63a9df3ed0d1a5153ee1faee66993ba0c9b8df23f7f936916cea38f879094139542081c0dd0978f3d15058258e3776541e7e7226e2e16d6e26ab0438b7a7e630d787", 0x116, 0x81}]) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x70bd28, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004800}, 0x80) 22:55:47 executing program 0 (fault-call:12 fault-nth:44): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x2812, r2, 0x0) perf_event_open(&(0x7f00000000c0)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1081}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000040)=ANY=[@ANYRES32=r3], 0x3) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 932.703929][T29620] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(0xffffffffffffffff, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 932.749594][T29626] FAULT_INJECTION: forcing a failure. [ 932.749594][T29626] name failslab, interval 1, probability 0, space 0, times 0 [ 932.762225][T29626] CPU: 0 PID: 29626 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 932.772351][T29626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 932.782393][T29626] Call Trace: [ 932.785664][T29626] dump_stack+0x1b0/0x21e [ 932.789972][T29626] ? devkmsg_release+0x11c/0x11c [ 932.794961][T29626] ? show_regs_print_info+0x12/0x12 [ 932.800313][T29626] ? get_random_u32+0x112/0x210 [ 932.805133][T29626] ? kasan_init_slab_obj+0x20/0x30 [ 932.810223][T29626] ? new_slab+0x21c/0x450 [ 932.814538][T29626] should_fail+0x6fb/0x860 [ 932.818930][T29626] ? setup_fault_attr+0x2b0/0x2b0 [ 932.823931][T29626] ? eth_get_headlen+0x240/0x240 [ 932.828848][T29626] ? iov_iter_advance+0x707/0xee0 [ 932.833846][T29626] ? __napi_alloc_skb+0xd6/0x520 [ 932.838751][T29626] should_failslab+0x5/0x20 [ 932.843228][T29626] kmem_cache_alloc+0x36/0x250 [ 932.848009][T29626] __napi_alloc_skb+0xd6/0x520 [ 932.852749][T29626] napi_get_frags+0x5c/0x100 [ 932.857320][T29626] tun_get_user+0x9ce/0x3400 [ 932.861880][T29626] ? tun_do_read+0x1f10/0x1f10 [ 932.866626][T29626] ? __perf_event_task_sched_in+0x4ed/0x550 [ 932.872511][T29626] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 932.878814][T29626] ? switch_mm_irqs_off+0x46e/0x870 [ 932.883989][T29626] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 932.890560][T29626] ? __rcu_read_lock+0x50/0x50 [ 932.895319][T29626] ? finish_task_switch+0x2be/0x4c0 [ 932.900487][T29626] tun_chr_write_iter+0x121/0x1a0 [ 932.905482][T29626] __vfs_write+0x579/0x700 [ 932.909881][T29626] ? __kernel_write+0x340/0x340 [ 932.914727][T29626] ? pipe_wait+0x1c9/0x280 [ 932.919131][T29626] ? pipe_double_lock+0x1a0/0x1a0 [ 932.924148][T29626] __kernel_write+0x12c/0x340 [ 932.928832][T29626] write_pipe_buf+0x148/0x1d0 [ 932.933485][T29626] ? splice_from_pipe_next+0x40e/0x440 [ 932.938914][T29626] ? default_file_splice_write+0x240/0x240 [ 932.944706][T29626] ? anon_pipe_buf_release+0x167/0x1c0 [ 932.950136][T29626] __splice_from_pipe+0x2d3/0x870 [ 932.955127][T29626] ? default_file_splice_write+0x240/0x240 [ 932.960906][T29626] default_file_splice_write+0x179/0x240 [ 932.966510][T29626] ? default_file_splice_read+0x920/0x920 [ 932.972213][T29626] ? avc_policy_seqno+0x17/0x70 [ 932.977033][T29626] ? security_file_permission+0x128/0x300 [ 932.982723][T29626] ? default_file_splice_read+0x920/0x920 [ 932.988418][T29626] __se_sys_splice+0x860/0x1b90 [ 932.993259][T29626] ? security_file_permission+0x128/0x300 [ 932.998947][T29626] ? fput_many+0x42/0x1a0 [ 933.003245][T29626] ? ksys_write+0x237/0x2a0 [ 933.007714][T29626] ? __x64_sys_splice+0xf0/0xf0 [ 933.012531][T29626] ? __x64_sys_splice+0x1d/0xf0 [ 933.017349][T29626] do_syscall_64+0xcb/0x150 [ 933.021824][T29626] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 933.027683][T29626] RIP: 0033:0x45d5b9 [ 933.031544][T29626] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 933.051116][T29626] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 933.059507][T29626] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 933.067447][T29626] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 933.075394][T29626] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 933.083341][T29626] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002c [ 933.091282][T29626] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:47 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:47 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 933.157176][T29633] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:48 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x8000000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:48 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:48 executing program 4: prlimit64(0x0, 0x8, &(0x7f0000000280)={0x9, 0x80000002}, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x801c0, 0x0) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000140)) r1 = getpid() sched_setattr(r1, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x4}, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f00000006c0)={0x6, {{0xa, 0x4e21, 0x5, @local}}, 0x0, 0x8, [{{0xa, 0x4e20, 0xa, @mcast1, 0x4}}, {{0xa, 0x4e20, 0x81, @remote, 0x3f}}, {{0xa, 0x4e22, 0x8, @local, 0x7ff}}, {{0xa, 0x4e23, 0x8001, @mcast2, 0x9}}, {{0xa, 0x4e22, 0x1f, @local}}, {{0xa, 0x4e21, 0x4, @mcast1, 0x2a}}, {{0xa, 0x4e23, 0x6, @remote, 0x1f}}, {{0xa, 0x4e24, 0x5, @remote, 0x5}}]}, 0x490) recvmmsg(r2, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) write(r4, &(0x7f0000000180), 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ftruncate(0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x2, 0x10000014, 0x0, 0x3, 0x0, 0x200000000000000, 0x0, 0xa82f, 0x8}, 0x0) r5 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r5, 0x1000) lseek(r5, 0x0, 0x2) r6 = open(&(0x7f0000000240)='./bus\x00', 0x0, 0x0) sendfile(r5, r6, 0x0, 0x8400fffffffa) creat(&(0x7f00000000c0)='./bus\x00', 0x0) 22:55:48 executing program 0 (fault-call:12 fault-nth:45): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 933.558983][T29648] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 933.636997][T29656] FAULT_INJECTION: forcing a failure. [ 933.636997][T29656] name failslab, interval 1, probability 0, space 0, times 0 [ 933.649652][T29656] CPU: 1 PID: 29656 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 933.659783][T29656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 933.669832][T29656] Call Trace: [ 933.673111][T29656] dump_stack+0x1b0/0x21e [ 933.677428][T29656] ? devkmsg_release+0x11c/0x11c [ 933.682349][T29656] ? show_regs_print_info+0x12/0x12 [ 933.687526][T29656] ? _raw_spin_lock+0xa1/0x170 [ 933.692277][T29656] ? _raw_spin_trylock_bh+0x190/0x190 [ 933.697629][T29656] ? _raw_spin_lock+0xa1/0x170 [ 933.702374][T29656] ? _raw_spin_trylock_bh+0x190/0x190 [ 933.707733][T29656] ? netif_receive_skb_list_internal+0x46a/0x720 [ 933.714050][T29656] should_fail+0x6fb/0x860 [ 933.718455][T29656] ? setup_fault_attr+0x2b0/0x2b0 [ 933.723462][T29656] ? eth_get_headlen+0x240/0x240 [ 933.728383][T29656] ? iov_iter_advance+0x707/0xee0 [ 933.733389][T29656] ? __napi_alloc_skb+0xd6/0x520 [ 933.738310][T29656] should_failslab+0x5/0x20 [ 933.742800][T29656] kmem_cache_alloc+0x36/0x250 [ 933.747547][T29656] __napi_alloc_skb+0xd6/0x520 [ 933.752295][T29656] napi_get_frags+0x5c/0x100 [ 933.756867][T29656] tun_get_user+0x9ce/0x3400 [ 933.761444][T29656] ? tun_do_read+0x1f10/0x1f10 [ 933.766191][T29656] ? __perf_event_task_sched_in+0x4ed/0x550 [ 933.772102][T29656] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 933.778414][T29656] ? switch_mm_irqs_off+0x46e/0x870 [ 933.783598][T29656] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 933.790263][T29656] ? __rcu_read_lock+0x50/0x50 [ 933.795015][T29656] ? finish_task_switch+0x2be/0x4c0 [ 933.800197][T29656] tun_chr_write_iter+0x121/0x1a0 [ 933.805209][T29656] __vfs_write+0x579/0x700 [ 933.809613][T29656] ? __kernel_write+0x340/0x340 [ 933.814448][T29656] ? pipe_wait+0x1c9/0x280 [ 933.818847][T29656] ? pipe_double_lock+0x1a0/0x1a0 [ 933.823854][T29656] __kernel_write+0x12c/0x340 [ 933.828518][T29656] write_pipe_buf+0x148/0x1d0 [ 933.833177][T29656] ? default_file_splice_write+0x240/0x240 [ 933.838966][T29656] __splice_from_pipe+0x2d3/0x870 [ 933.843974][T29656] ? default_file_splice_write+0x240/0x240 [ 933.849765][T29656] default_file_splice_write+0x179/0x240 [ 933.855379][T29656] ? default_file_splice_read+0x920/0x920 [ 933.861083][T29656] ? avc_policy_seqno+0x17/0x70 [ 933.865921][T29656] ? security_file_permission+0x128/0x300 [ 933.871620][T29656] ? default_file_splice_read+0x920/0x920 [ 933.877324][T29656] __se_sys_splice+0x860/0x1b90 [ 933.882159][T29656] ? security_file_permission+0x128/0x300 [ 933.887862][T29656] ? fput_many+0x42/0x1a0 [ 933.892177][T29656] ? ksys_write+0x237/0x2a0 [ 933.896661][T29656] ? __x64_sys_splice+0xf0/0xf0 [ 933.901495][T29656] ? __x64_sys_splice+0x1d/0xf0 [ 933.906331][T29656] do_syscall_64+0xcb/0x150 [ 933.910819][T29656] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 933.916698][T29656] RIP: 0033:0x45d5b9 22:55:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB='\b\x00'], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 933.920577][T29656] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 933.940166][T29656] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 933.948566][T29656] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 933.956525][T29656] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 933.964482][T29656] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 933.972444][T29656] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002d [ 933.980404][T29656] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:48 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x0, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:48 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB='\b\x00'], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x8004000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB='\b\x00'], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:49 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x0, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000041c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x0, 0x3}, 0x0) r4 = socket(0x10, 0x3, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) setsockopt$inet_mreq(r5, 0x0, 0x0, &(0x7f0000000040)={@multicast2, @private=0xa010100}, 0x8) write(r4, &(0x7f0000000200)="1400000052001f0214f9f4070009040081000710", 0x14) 22:55:49 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:49 executing program 0 (fault-call:12 fault-nth:46): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 934.546173][T29687] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 934.591374][T29692] FAULT_INJECTION: forcing a failure. [ 934.591374][T29692] name failslab, interval 1, probability 0, space 0, times 0 [ 934.604404][T29692] CPU: 1 PID: 29692 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 934.614536][T29692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 934.624582][T29692] Call Trace: [ 934.627845][T29692] dump_stack+0x1b0/0x21e [ 934.632144][T29692] ? devkmsg_release+0x11c/0x11c [ 934.637047][T29692] ? show_regs_print_info+0x12/0x12 [ 934.642219][T29692] ? __rcu_read_lock+0x50/0x50 [ 934.646963][T29692] ? get_random_u32+0x112/0x210 [ 934.651789][T29692] ? kasan_init_slab_obj+0x20/0x30 [ 934.656881][T29692] should_fail+0x6fb/0x860 [ 934.661288][T29692] ? setup_fault_attr+0x2b0/0x2b0 [ 934.666295][T29692] ? setup_fault_attr+0x2b0/0x2b0 [ 934.671304][T29692] ? eth_get_headlen+0x240/0x240 [ 934.676223][T29692] ? tun_get_user+0xc08/0x3400 [ 934.680968][T29692] should_failslab+0x5/0x20 [ 934.685456][T29692] __kmalloc_track_caller+0x5d/0x2b0 [ 934.690722][T29692] ? __napi_alloc_skb+0xd6/0x520 [ 934.695642][T29692] ? tun_get_user+0xc08/0x3400 [ 934.700389][T29692] pskb_expand_head+0x10d/0xfb0 [ 934.705227][T29692] tun_get_user+0xc08/0x3400 [ 934.709807][T29692] ? __perf_event_task_sched_out+0x1127/0x1250 [ 934.715945][T29692] ? tun_do_read+0x1f10/0x1f10 [ 934.720697][T29692] ? __perf_event_task_sched_in+0x4ed/0x550 [ 934.726580][T29692] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 934.733153][T29692] ? __rcu_read_lock+0x50/0x50 [ 934.737900][T29692] ? find_next_bit+0xf7/0x120 [ 934.742549][T29692] ? finish_task_switch+0x2be/0x4c0 [ 934.747718][T29692] tun_chr_write_iter+0x121/0x1a0 [ 934.752710][T29692] __vfs_write+0x579/0x700 [ 934.757095][T29692] ? __kernel_write+0x340/0x340 [ 934.761974][T29692] ? pipe_wait+0x1c9/0x280 [ 934.766358][T29692] ? pipe_double_lock+0x1a0/0x1a0 [ 934.771355][T29692] __kernel_write+0x12c/0x340 [ 934.776009][T29692] write_pipe_buf+0x148/0x1d0 [ 934.780661][T29692] ? default_file_splice_write+0x240/0x240 [ 934.786450][T29692] __splice_from_pipe+0x2d3/0x870 [ 934.791443][T29692] ? default_file_splice_write+0x240/0x240 [ 934.797216][T29692] default_file_splice_write+0x179/0x240 [ 934.802825][T29692] ? default_file_splice_read+0x920/0x920 [ 934.808519][T29692] ? avc_policy_seqno+0x17/0x70 [ 934.813340][T29692] ? security_file_permission+0x128/0x300 [ 934.819032][T29692] ? default_file_splice_read+0x920/0x920 [ 934.824775][T29692] __se_sys_splice+0x860/0x1b90 [ 934.829597][T29692] ? security_file_permission+0x128/0x300 [ 934.835305][T29692] ? fput_many+0x42/0x1a0 [ 934.839602][T29692] ? ksys_write+0x237/0x2a0 [ 934.844069][T29692] ? __x64_sys_splice+0xf0/0xf0 [ 934.848885][T29692] ? __x64_sys_splice+0x1d/0xf0 [ 934.853709][T29692] do_syscall_64+0xcb/0x150 [ 934.858192][T29692] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 934.864052][T29692] RIP: 0033:0x45d5b9 [ 934.867922][T29692] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000100)) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 934.887497][T29692] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 934.895888][T29692] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 934.903921][T29692] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 934.911885][T29692] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 934.919840][T29692] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002e [ 934.927781][T29692] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000100)) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:49 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x9501000000000000}, 0x2}], 0x1, 0x2, 0x0) [ 934.957960][T29699] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:49 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, 0x0, &(0x7f0000000100)) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:49 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 935.078623][T29711] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:50 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$netlink(0x10, 0x3, 0xe) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$KDFONTOP_SET_DEF(0xffffffffffffffff, 0x4b72, &(0x7f0000000000)={0x2, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)="267266db399c46d56a0f48343d202db17bc2e62d794bd9bdcf4104cb015322794d326bfaeb4e449a5cf7be28eba398b30692944219d9d9af6270b05ed243c2b77f9b71e5328833d4c252cd19cf7013b47808343c538ce86b1e673a466dca219f7c03f59626ce53396572fa0d12b0f637c5071566a8de940982cf0abe74e25efb5f7473af1a8498226b7619cb92903e64aa775798f0fb7fb011f7400a0e3b48ecdbad132b9c56f8091403bf88aa50096772b8ac1ea949ea842b3f4434a8e3596ff37381ca644ef09b8f688a6f5f1abce751d21aa8b39f5f4f1e73b2fde78b54e9597da6be693eda95984d24117538bcc0fa7c4ba267deeaace7c9681d232159c8ff865c0e4fee8f1b490fd904f2fb73308b8567e463dbbce95c86751aceaca63a6a6871a45b1eea96988bd66bedc5dcb60fb6e2557b9f9f86ab76a7c0e30ec1ed882f0831f03577e0fc25c4d831a625a4c0908be1da08c467abcd4f8d5bd4e0757312e656966628e5d8c07c6a6198f006274781cdf29d21ac37ea8254e1b5b7b650fe8179bf33797acb5b1349b78b18137d4074a68737ce713c67f9a7ce1fa96dd9f7d2f9594b51571c4bf9eb72031523eee686510d6cdfded9ce8fe504188177e55e6217873d67519e62fab07562094d30a78a44bedb5c8038222046aea952054c8bdbc2649a9528dd4cb6e8338128426897da67e89d5ea522977ef9f9f502481db3b42ad52d683b4d96e3b14976b66cba348eeaf48e27ad559e40c188de1ce8da6a98dd83f26231f2d2e5b3c9e69b581690fe1fceae8909c1c8ced17a034967bf20799f546f5eaf6692ff64727d3bd3c4a62ebd62fac28b7ae09d1ab575d14b16266bc47d21de2e77f4028cad88855b385a3f5fa16f24f827dc8c7dbd83113e3892426c1c37387da4f6126ef87968bd49e4409b5399e3dcea7cb9e58d7a4298aeef26a72fbb0c91c30a81c917e2d322760d33268541b66fbf569166b694a29126e47dad1f61a54550d4dca195fa50467ffac50af51c46ea20a8216f93d45d68c1a356a4c857fdc7f651edb2d7ec0efd7ca423cbbee34aa71f1d56c5237b6d03ef7bc277bde1a772a9e11f294a025c7500cad15d73bfb1947a92ca8c94a3e6aae03bfef238e42ab616df0e9fdb44c56dbaf4134b7ce34280a4a4d0cc3e1ed0f5d5bd4f675da8442157e6da430937c343e40bc3e17d3e1c4679cfb02286cb453b5921b57dabf1160b9b53e48f1629a55dd17d0bcfa03a0b3ab5ec0ed13953c3f0c4aaff9b7e8c06bc83fd487a439a3a21f41be7be0bbbbde3f44bb7f67cb966f1ed511630d0cb7ae001af54ea8bb21f03283ad000aff323b85e1297dc9df75846345d64c98cae278f2f3cc1f3ffa79bc9d9a8b16f4a400edd2fd329bd564cb1a1450074843e6f96124533f2d8fbabe7dba93649dedc97c83a2ef0f8bcd1805ae7"}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="d4000000190019"], 0x1}}, 0x0) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x4240a2a0) splice(r0, 0x0, r2, 0x0, 0x4ffe0, 0x0) 22:55:50 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:50 executing program 0 (fault-call:12 fault-nth:47): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 935.443318][T29717] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 935.505445][T29727] FAULT_INJECTION: forcing a failure. [ 935.505445][T29727] name failslab, interval 1, probability 0, space 0, times 0 [ 935.518931][T29727] CPU: 0 PID: 29727 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 935.529171][T29727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 935.539233][T29727] Call Trace: [ 935.542504][T29727] dump_stack+0x1b0/0x21e [ 935.546801][T29727] ? devkmsg_release+0x11c/0x11c [ 935.551701][T29727] ? show_regs_print_info+0x12/0x12 [ 935.556887][T29727] ? __rcu_read_lock+0x50/0x50 [ 935.561617][T29727] ? _raw_spin_lock+0xa1/0x170 [ 935.566347][T29727] should_fail+0x6fb/0x860 [ 935.570727][T29727] ? setup_fault_attr+0x2b0/0x2b0 [ 935.576254][T29727] ? setup_fault_attr+0x2b0/0x2b0 [ 935.581255][T29727] ? eth_get_headlen+0x240/0x240 [ 935.586332][T29727] ? tun_get_user+0xc08/0x3400 [ 935.591072][T29727] should_failslab+0x5/0x20 [ 935.595541][T29727] __kmalloc_track_caller+0x5d/0x2b0 [ 935.600794][T29727] ? __napi_alloc_skb+0xd6/0x520 [ 935.605699][T29727] ? tun_get_user+0xc08/0x3400 [ 935.610426][T29727] pskb_expand_head+0x10d/0xfb0 [ 935.615244][T29727] tun_get_user+0xc08/0x3400 [ 935.619803][T29727] ? __perf_event_task_sched_out+0x1127/0x1250 [ 935.625933][T29727] ? tun_do_read+0x1f10/0x1f10 [ 935.630669][T29727] ? __perf_event_task_sched_in+0x4ed/0x550 [ 935.636528][T29727] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 935.643079][T29727] ? __rcu_read_lock+0x50/0x50 [ 935.647808][T29727] ? find_next_bit+0xf7/0x120 [ 935.652450][T29727] ? finish_task_switch+0x2be/0x4c0 [ 935.657612][T29727] tun_chr_write_iter+0x121/0x1a0 [ 935.662602][T29727] __vfs_write+0x579/0x700 [ 935.666995][T29727] ? __kernel_write+0x340/0x340 [ 935.671810][T29727] ? pipe_wait+0x1c9/0x280 [ 935.676202][T29727] ? pipe_double_lock+0x1a0/0x1a0 [ 935.681192][T29727] __kernel_write+0x12c/0x340 [ 935.685835][T29727] write_pipe_buf+0x148/0x1d0 [ 935.690477][T29727] ? default_file_splice_write+0x240/0x240 [ 935.696334][T29727] __splice_from_pipe+0x2d3/0x870 [ 935.701335][T29727] ? default_file_splice_write+0x240/0x240 [ 935.707103][T29727] default_file_splice_write+0x179/0x240 [ 935.712698][T29727] ? default_file_splice_read+0x920/0x920 [ 935.718381][T29727] ? avc_policy_seqno+0x17/0x70 [ 935.723217][T29727] ? security_file_permission+0x128/0x300 [ 935.728899][T29727] ? default_file_splice_read+0x920/0x920 [ 935.734592][T29727] __se_sys_splice+0x860/0x1b90 [ 935.739421][T29727] ? security_file_permission+0x128/0x300 [ 935.745102][T29727] ? fput_many+0x42/0x1a0 [ 935.749395][T29727] ? ksys_write+0x237/0x2a0 [ 935.753862][T29727] ? __x64_sys_splice+0xf0/0xf0 [ 935.758678][T29727] ? __x64_sys_splice+0x1d/0xf0 [ 935.763504][T29727] do_syscall_64+0xcb/0x150 [ 935.767972][T29727] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 935.773828][T29727] RIP: 0033:0x45d5b9 [ 935.777703][T29727] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 935.797406][T29727] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:50 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x9bc4200000000000}, 0x2}], 0x1, 0x2, 0x0) [ 935.805835][T29727] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 935.813775][T29727] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 935.821755][T29727] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 935.829691][T29727] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000002f [ 935.837631][T29727] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 935.890329][T29736] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:50 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32, @ANYBLOB="08001b"], 0x34}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:55:50 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(0xffffffffffffffff, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 935.999455][T29746] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:55:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:51 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:51 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:51 executing program 4: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r1, 0x407, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f00000001c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB="2c726f6f746d6f64653d30303030303050303030303030303030303036303030302c757365f2e050093b88ccb170e13a5f69643d", @ANYRESDEC, @ANYBLOB="03000000643d", @ANYRESDEC=0x0]) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) r5 = syz_usb_connect$hid(0x6, 0x36, &(0x7f0000000000)=ANY=[@ANYRES64=r1, @ANYRES16=r1, @ANYRESOCT=r3], 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r7) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000001540)={{{@in=@initdev, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@ipv4={[], [], @dev}}}, &(0x7f0000000280)=0xe8) setreuid(r7, r8) syz_usb_control_io(r5, &(0x7f0000000180)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="00005a00000022009000"/22], 0x0, 0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000000c0), 0x4) 22:55:51 executing program 0 (fault-call:12 fault-nth:48): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 936.308402][T29752] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:51 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 936.395901][T29761] FAULT_INJECTION: forcing a failure. [ 936.395901][T29761] name failslab, interval 1, probability 0, space 0, times 0 [ 936.413186][T29761] CPU: 1 PID: 29761 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 936.423656][T29761] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 936.433779][T29761] Call Trace: [ 936.437048][T29761] dump_stack+0x1b0/0x21e [ 936.441351][T29761] ? devkmsg_release+0x11c/0x11c [ 936.446258][T29761] ? show_regs_print_info+0x12/0x12 [ 936.451427][T29761] ? __rcu_read_lock+0x50/0x50 [ 936.456159][T29761] ? get_random_u32+0x112/0x210 [ 936.460978][T29761] ? kasan_init_slab_obj+0x20/0x30 [ 936.466078][T29761] should_fail+0x6fb/0x860 [ 936.470479][T29761] ? setup_fault_attr+0x2b0/0x2b0 [ 936.475481][T29761] ? setup_fault_attr+0x2b0/0x2b0 [ 936.480475][T29761] ? eth_get_headlen+0x240/0x240 [ 936.485377][T29761] ? tun_get_user+0xc08/0x3400 [ 936.490115][T29761] should_failslab+0x5/0x20 [ 936.494623][T29761] __kmalloc_track_caller+0x5d/0x2b0 [ 936.499884][T29761] ? __napi_alloc_skb+0xd6/0x520 [ 936.504797][T29761] ? tun_get_user+0xc08/0x3400 [ 936.509533][T29761] pskb_expand_head+0x10d/0xfb0 [ 936.514387][T29761] tun_get_user+0xc08/0x3400 [ 936.518956][T29761] ? tun_do_read+0x1f10/0x1f10 [ 936.523690][T29761] ? __perf_event_task_sched_in+0x4ed/0x550 [ 936.529560][T29761] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 936.535864][T29761] ? switch_mm_irqs_off+0x46e/0x870 [ 936.541041][T29761] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 936.547599][T29761] ? __rcu_read_lock+0x50/0x50 [ 936.552332][T29761] ? finish_task_switch+0x2be/0x4c0 [ 936.557509][T29761] tun_chr_write_iter+0x121/0x1a0 [ 936.562521][T29761] __vfs_write+0x579/0x700 [ 936.566907][T29761] ? __kernel_write+0x340/0x340 [ 936.571766][T29761] ? pipe_wait+0x1c9/0x280 [ 936.576191][T29761] ? pipe_double_lock+0x1a0/0x1a0 [ 936.581193][T29761] __kernel_write+0x12c/0x340 [ 936.586022][T29761] write_pipe_buf+0x148/0x1d0 [ 936.590674][T29761] ? default_file_splice_write+0x240/0x240 [ 936.596446][T29761] __splice_from_pipe+0x2d3/0x870 [ 936.601452][T29761] ? default_file_splice_write+0x240/0x240 [ 936.607223][T29761] default_file_splice_write+0x179/0x240 [ 936.612822][T29761] ? default_file_splice_read+0x920/0x920 [ 936.618506][T29761] ? avc_policy_seqno+0x17/0x70 [ 936.623341][T29761] ? security_file_permission+0x128/0x300 [ 936.629031][T29761] ? default_file_splice_read+0x920/0x920 [ 936.634726][T29761] __se_sys_splice+0x860/0x1b90 [ 936.639544][T29761] ? security_file_permission+0x128/0x300 [ 936.645238][T29761] ? fput_many+0x42/0x1a0 [ 936.649532][T29761] ? ksys_write+0x237/0x2a0 [ 936.654004][T29761] ? __x64_sys_splice+0xf0/0xf0 [ 936.658820][T29761] ? __x64_sys_splice+0x1d/0xf0 [ 936.663634][T29761] do_syscall_64+0xcb/0x150 [ 936.668109][T29761] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 936.673967][T29761] RIP: 0033:0x45d5b9 [ 936.677830][T29761] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:55:51 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xe803000000000000}, 0x2}], 0x1, 0x2, 0x0) [ 936.697409][T29761] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 936.705802][T29761] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 936.713755][T29761] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 936.721715][T29761] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 936.729673][T29761] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000030 [ 936.737628][T29761] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:51 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="87f44eb73d099193745d7b122a09e3e85d964b12556e0094673f230cf3f8b48e857140000001090224010000092100"/58], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, &(0x7f0000000c40)={0x14, &(0x7f0000000500)=ANY=[@ANYBLOB="05006c"], 0x0}, 0x0) syz_usb_control_io(r0, &(0x7f0000000640)={0x2c, 0x0, &(0x7f0000000080)={0x0, 0x3, 0x4, @lang_id={0x4}}, 0x0, 0x0, 0x0}, 0x0) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0003020000000203"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$printer(r1, &(0x7f0000000480)={0x14, 0x0, &(0x7f0000000540)={0x0, 0x3, 0x12, @string={0x12, 0x3, "290dd794645bcf44d7b47ce49664b564"}}}, 0x0) 22:55:51 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:51 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 936.849979][T29780] __nla_validate_parse: 1 callbacks suppressed [ 936.849985][T29780] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 937.095772][ T4421] usb 5-1: new high-speed USB device number 66 using dummy_hcd 22:55:52 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:52 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote}, 0x14) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:52 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:52 executing program 0 (fault-call:12 fault-nth:49): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:52 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 937.213878][T29788] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 937.299406][T29793] FAULT_INJECTION: forcing a failure. [ 937.299406][T29793] name failslab, interval 1, probability 0, space 0, times 0 [ 937.312173][T29793] CPU: 1 PID: 29793 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 937.322333][T29793] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 937.332360][T29793] Call Trace: [ 937.335623][T29793] dump_stack+0x1b0/0x21e [ 937.339930][T29793] ? devkmsg_release+0x11c/0x11c [ 937.344841][T29793] ? show_regs_print_info+0x12/0x12 [ 937.350009][T29793] ? __rcu_read_lock+0x50/0x50 [ 937.354740][T29793] ? get_random_u32+0x112/0x210 [ 937.359573][T29793] ? kasan_init_slab_obj+0x20/0x30 [ 937.364654][T29793] should_fail+0x6fb/0x860 [ 937.365749][ T4421] usb 5-1: device descriptor read/64, error 18 [ 937.369044][T29793] ? setup_fault_attr+0x2b0/0x2b0 [ 937.369052][T29793] ? setup_fault_attr+0x2b0/0x2b0 [ 937.369068][T29793] ? eth_get_headlen+0x240/0x240 [ 937.369081][T29793] ? tun_get_user+0xc08/0x3400 [ 937.394831][T29793] should_failslab+0x5/0x20 [ 937.399307][T29793] __kmalloc_track_caller+0x5d/0x2b0 [ 937.404571][T29793] ? __napi_alloc_skb+0xd6/0x520 [ 937.409488][T29793] ? tun_get_user+0xc08/0x3400 [ 937.414224][T29793] pskb_expand_head+0x10d/0xfb0 [ 937.419048][T29793] tun_get_user+0xc08/0x3400 [ 937.423620][T29793] ? __perf_event_task_sched_out+0x1127/0x1250 [ 937.429754][T29793] ? tun_do_read+0x1f10/0x1f10 [ 937.434495][T29793] ? __perf_event_task_sched_in+0x4ed/0x550 [ 937.440360][T29793] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 937.446919][T29793] ? __rcu_read_lock+0x50/0x50 [ 937.451660][T29793] ? find_next_bit+0xf7/0x120 [ 937.456306][T29793] ? finish_task_switch+0x2be/0x4c0 [ 937.461472][T29793] tun_chr_write_iter+0x121/0x1a0 [ 937.466470][T29793] __vfs_write+0x579/0x700 [ 937.470855][T29793] ? __kernel_write+0x340/0x340 [ 937.475694][T29793] ? pipe_wait+0x1c9/0x280 [ 937.480101][T29793] ? pipe_double_lock+0x1a0/0x1a0 [ 937.485122][T29793] __kernel_write+0x12c/0x340 [ 937.489772][T29793] write_pipe_buf+0x148/0x1d0 [ 937.494419][T29793] ? default_file_splice_write+0x240/0x240 [ 937.500195][T29793] __splice_from_pipe+0x2d3/0x870 [ 937.505334][T29793] ? default_file_splice_write+0x240/0x240 [ 937.511145][T29793] default_file_splice_write+0x179/0x240 [ 937.516759][T29793] ? default_file_splice_read+0x920/0x920 [ 937.522485][T29793] ? avc_policy_seqno+0x17/0x70 [ 937.527322][T29793] ? security_file_permission+0x128/0x300 [ 937.533024][T29793] ? default_file_splice_read+0x920/0x920 [ 937.538722][T29793] __se_sys_splice+0x860/0x1b90 [ 937.543543][T29793] ? security_file_permission+0x128/0x300 [ 937.549252][T29793] ? fput_many+0x42/0x1a0 [ 937.553547][T29793] ? ksys_write+0x237/0x2a0 [ 937.558018][T29793] ? __x64_sys_splice+0xf0/0xf0 [ 937.562833][T29793] ? __x64_sys_splice+0x1d/0xf0 [ 937.567652][T29793] do_syscall_64+0xcb/0x150 [ 937.572122][T29793] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 937.577979][T29793] RIP: 0033:0x45d5b9 22:55:52 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xf401000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:52 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:52 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 937.581841][T29793] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 937.601409][T29793] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 937.609790][T29793] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 937.617737][T29793] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 937.625694][T29793] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 937.633638][T29793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000031 [ 937.641578][T29793] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:52 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) socket$inet_udp(0x2, 0x2, 0x0) r3 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 937.682852][T29801] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 937.755791][ T4421] usb 5-1: device descriptor read/64, error 18 [ 938.035735][ T4421] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 938.315695][ T4421] usb 5-1: device descriptor read/64, error 18 [ 938.705673][ T4421] usb 5-1: device descriptor read/64, error 18 [ 938.825777][ T4421] usb usb5-port1: attempt power cycle [ 939.535633][ T4421] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 939.705713][ T4421] usb 5-1: device descriptor read/8, error -61 22:55:54 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x40) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000300)={r0, 0x0}, 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xb, 0x6, 0x209e20, 0x2, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000300)}, 0x20) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={r1, &(0x7f0000000000), &(0x7f0000000140)=""/130}, 0x18) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x8, &(0x7f0000000000)=0x0) io_destroy(r3) r4 = dup2(r2, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = open(&(0x7f0000000080)='./file0\x00', 0x4a000, 0x16) r6 = fcntl$dupfd(r1, 0x0, r4) write$FUSE_WRITE(r6, &(0x7f0000000280)={0x18, 0x0, 0x0, {0x1}}, 0x18) getsockopt$inet_tcp_int(r5, 0x6, 0x10, &(0x7f0000000100), &(0x7f0000000240)=0x4) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000200)={r1, &(0x7f00000000c0)="bfecfadd68", &(0x7f0000000340)=""/193}, 0x20) 22:55:54 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:54 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB, @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:54 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, 0x0, 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:54 executing program 0 (fault-call:12 fault-nth:50): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:54 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xff00000000000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:54 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:54 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 939.842902][T29811] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:54 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 939.925759][ T4421] usb 5-1: device descriptor read/8, error -71 [ 939.946626][T29827] FAULT_INJECTION: forcing a failure. [ 939.946626][T29827] name failslab, interval 1, probability 0, space 0, times 0 [ 939.959492][T29827] CPU: 1 PID: 29827 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 939.969632][T29827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 939.979659][T29827] Call Trace: [ 939.982923][T29827] dump_stack+0x1b0/0x21e [ 939.987225][T29827] ? devkmsg_release+0x11c/0x11c [ 939.992129][T29827] ? show_regs_print_info+0x12/0x12 [ 939.997298][T29827] ? __rcu_read_lock+0x50/0x50 [ 940.002029][T29827] ? get_random_u32+0x112/0x210 [ 940.006848][T29827] ? kasan_init_slab_obj+0x20/0x30 [ 940.011925][T29827] should_fail+0x6fb/0x860 [ 940.016307][T29827] ? setup_fault_attr+0x2b0/0x2b0 [ 940.021297][T29827] ? setup_fault_attr+0x2b0/0x2b0 [ 940.026287][T29827] ? eth_get_headlen+0x240/0x240 [ 940.031242][T29827] ? tun_get_user+0xc08/0x3400 [ 940.035977][T29827] should_failslab+0x5/0x20 [ 940.040461][T29827] __kmalloc_track_caller+0x5d/0x2b0 [ 940.045714][T29827] ? __napi_alloc_skb+0xd6/0x520 [ 940.050635][T29827] ? tun_get_user+0xc08/0x3400 [ 940.055364][T29827] pskb_expand_head+0x10d/0xfb0 [ 940.060184][T29827] tun_get_user+0xc08/0x3400 [ 940.064747][T29827] ? __perf_event_task_sched_out+0x1127/0x1250 [ 940.070964][T29827] ? tun_do_read+0x1f10/0x1f10 [ 940.075698][T29827] ? __perf_event_task_sched_in+0x4ed/0x550 [ 940.081562][T29827] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 940.088116][T29827] ? __rcu_read_lock+0x50/0x50 [ 940.092857][T29827] ? find_next_bit+0xf7/0x120 [ 940.097502][T29827] ? finish_task_switch+0x2be/0x4c0 [ 940.102667][T29827] tun_chr_write_iter+0x121/0x1a0 [ 940.107657][T29827] __vfs_write+0x579/0x700 [ 940.112040][T29827] ? __kernel_write+0x340/0x340 [ 940.116858][T29827] ? pipe_wait+0x1c9/0x280 [ 940.121251][T29827] ? pipe_double_lock+0x1a0/0x1a0 [ 940.126242][T29827] __kernel_write+0x12c/0x340 [ 940.130886][T29827] write_pipe_buf+0x148/0x1d0 [ 940.135531][T29827] ? default_file_splice_write+0x240/0x240 [ 940.141316][T29827] __splice_from_pipe+0x2d3/0x870 [ 940.146309][T29827] ? default_file_splice_write+0x240/0x240 [ 940.152081][T29827] default_file_splice_write+0x179/0x240 [ 940.157688][T29827] ? default_file_splice_read+0x920/0x920 [ 940.163373][T29827] ? avc_policy_seqno+0x17/0x70 [ 940.168192][T29827] ? security_file_permission+0x128/0x300 [ 940.173880][T29827] ? default_file_splice_read+0x920/0x920 [ 940.179565][T29827] __se_sys_splice+0x860/0x1b90 [ 940.184385][T29827] ? security_file_permission+0x128/0x300 [ 940.190069][T29827] ? fput_many+0x42/0x1a0 [ 940.194367][T29827] ? ksys_write+0x237/0x2a0 [ 940.198837][T29827] ? __x64_sys_splice+0xf0/0xf0 [ 940.203654][T29827] ? __x64_sys_splice+0x1d/0xf0 [ 940.208471][T29827] do_syscall_64+0xcb/0x150 [ 940.212941][T29827] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 940.218801][T29827] RIP: 0033:0x45d5b9 [ 940.222665][T29827] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 940.242237][T29827] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 940.250614][T29827] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 940.258553][T29827] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 940.266492][T29827] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 22:55:55 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 940.274432][T29827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000032 [ 940.282381][T29827] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:55 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_DEV_INFO(r2, 0xd000941e, &(0x7f0000000600)={0x0, "56635912ee7c6373a911438bc5f69b37"}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000005c0)='nl80211\x00') sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x20, r3, 0x11, 0x0, 0x0, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x1}}]}, 0x20}}, 0x0) sendfile(r2, r1, 0x0, 0x100000001) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) pwritev(r0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5fcb5da6c8a5e5286ac6f66430e4fbc7f49724a4e8753bdad3466f8cd0781fde0f35e1df88a7f937191c4d3762b28651092960cf4231c736b1f4112819b699bd4ebb58a32deb54f5d769365ae9b18b0d789775c8ec309001e4395026623d4ff6b9305ecd1a17ed86138b44330a835c14f4bfdf572fb5c8e6a8a470271562f3", 0x7f}, {&(0x7f0000000040)="782c7991918ddab7d2156ade717673c1ca4fa7afe8d85bdfac019bb037f84ee96d212689f1b91a86d649", 0x2a}], 0x2, 0x5, 0x1) 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 940.319040][T29832] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:55 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 940.420191][T29846] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:55 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:55 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:55 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0xffffffff00000000}, 0x2}], 0x1, 0x2, 0x0) 22:55:55 executing program 0 (fault-call:12 fault-nth:51): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:55 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, 0x0, 0x0) [ 940.766870][T29855] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 940.827718][T29864] FAULT_INJECTION: forcing a failure. [ 940.827718][T29864] name failslab, interval 1, probability 0, space 0, times 0 [ 940.840515][T29864] CPU: 1 PID: 29864 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 940.850667][T29864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 940.860694][T29864] Call Trace: [ 940.863954][T29864] dump_stack+0x1b0/0x21e [ 940.868249][T29864] ? devkmsg_release+0x11c/0x11c [ 940.873155][T29864] ? show_regs_print_info+0x12/0x12 [ 940.878321][T29864] ? __rcu_read_lock+0x50/0x50 [ 940.883052][T29864] ? get_random_u32+0x112/0x210 [ 940.887872][T29864] ? kasan_init_slab_obj+0x20/0x30 [ 940.892954][T29864] should_fail+0x6fb/0x860 [ 940.897356][T29864] ? setup_fault_attr+0x2b0/0x2b0 [ 940.902347][T29864] ? setup_fault_attr+0x2b0/0x2b0 [ 940.907340][T29864] ? eth_get_headlen+0x240/0x240 [ 940.912248][T29864] ? tun_get_user+0xc08/0x3400 [ 940.916983][T29864] should_failslab+0x5/0x20 [ 940.921463][T29864] __kmalloc_track_caller+0x5d/0x2b0 [ 940.926723][T29864] ? __napi_alloc_skb+0xd6/0x520 [ 940.931679][T29864] ? tun_get_user+0xc08/0x3400 [ 940.936411][T29864] pskb_expand_head+0x10d/0xfb0 [ 940.941237][T29864] tun_get_user+0xc08/0x3400 [ 940.945795][T29864] ? tun_do_read+0x1f10/0x1f10 [ 940.950529][T29864] ? __perf_event_task_sched_in+0x4ed/0x550 [ 940.956389][T29864] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 940.962681][T29864] ? switch_mm_irqs_off+0x46e/0x870 [ 940.967858][T29864] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 940.974423][T29864] ? __rcu_read_lock+0x50/0x50 [ 940.979168][T29864] ? _raw_spin_unlock_irq+0x5/0x20 [ 940.984254][T29864] ? finish_task_switch+0x235/0x4c0 [ 940.989458][T29864] tun_chr_write_iter+0x121/0x1a0 [ 940.994468][T29864] __vfs_write+0x579/0x700 [ 940.998861][T29864] ? __kernel_write+0x340/0x340 [ 941.003682][T29864] ? pipe_wait+0x1c9/0x280 [ 941.008064][T29864] ? pipe_double_lock+0x1a0/0x1a0 [ 941.013055][T29864] __kernel_write+0x12c/0x340 [ 941.017706][T29864] write_pipe_buf+0x148/0x1d0 [ 941.022355][T29864] ? default_file_splice_write+0x240/0x240 [ 941.028131][T29864] __splice_from_pipe+0x2d3/0x870 [ 941.033123][T29864] ? default_file_splice_write+0x240/0x240 [ 941.038896][T29864] default_file_splice_write+0x179/0x240 [ 941.044494][T29864] ? default_file_splice_read+0x920/0x920 [ 941.050178][T29864] ? avc_policy_seqno+0x17/0x70 [ 941.055006][T29864] ? security_file_permission+0x128/0x300 [ 941.060694][T29864] ? default_file_splice_read+0x920/0x920 [ 941.066378][T29864] __se_sys_splice+0x860/0x1b90 [ 941.071461][T29864] ? security_file_permission+0x128/0x300 [ 941.077161][T29864] ? fput_many+0x42/0x1a0 [ 941.081473][T29864] ? ksys_write+0x237/0x2a0 [ 941.085956][T29864] ? __x64_sys_splice+0xf0/0xf0 [ 941.090787][T29864] ? __x64_sys_splice+0x1d/0xf0 [ 941.095610][T29864] do_syscall_64+0xcb/0x150 [ 941.100085][T29864] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 941.105944][T29864] RIP: 0033:0x45d5b9 22:55:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:56 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, 0x0, 0x0) [ 941.109804][T29864] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 941.129372][T29864] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 941.137751][T29864] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 941.145694][T29864] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 941.153656][T29864] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 941.161645][T29864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000033 [ 941.169588][T29864] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:56 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) accept(r2, &(0x7f0000000180)=@hci, &(0x7f0000000280)=0x80) r3 = fcntl$dupfd(r0, 0x0, r1) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000b80)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000000000008f80000030000003003000098020006000000db5300000000000000000000009802000098020000a10200009802000098020000030080000000000000000000ffffffffe00000040000000000000000e4000000010000000000bd00000000007465616d5f736c6176655f310000000000000000000000000000000000c10000000000000000000000000000000000000000000000000000c001080200000000000000000000000000000000000000005001686173686c696d6974000000000000000000000000000000000000000002726f73653000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002100000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000300000007000000000000000000000000000000480043540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004ead4934420067a90020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000400000000000000000000000000000070009000000000000000000000000000000000000000000020004e4f545241434b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004007000980000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff"], 0x1) r4 = socket(0x2, 0x3, 0x100000001) bind$inet(r4, &(0x7f0000000080)={0x2, 0x0, @local}, 0x79) recvfrom$unix(0xffffffffffffffff, &(0x7f0000000040)=""/37, 0x25, 0x12000, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) connect$inet(r4, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sendto(r5, &(0x7f0000000600)="1400", 0x2, 0x8002, 0x0, 0x0) write$binfmt_elf32(r4, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x11, 0x2f00000000000000, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}]}, 0x58) 22:55:56 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, 0x0, 0x0) [ 941.220675][T29870] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 941.333010][T29878] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:56 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:56 executing program 3 (fault-call:8 fault-nth:0): r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:56 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1}, 0x2}], 0x1, 0x2, 0x0) 22:55:56 executing program 0 (fault-call:12 fault-nth:52): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:55:56 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:55:56 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0x2, 0x0, 0x0, @empty}, 0x1c) [ 941.628386][T29889] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 941.705137][T29898] FAULT_INJECTION: forcing a failure. [ 941.705137][T29898] name failslab, interval 1, probability 0, space 0, times 0 [ 941.717768][T29898] CPU: 1 PID: 29898 Comm: syz-executor.0 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 941.727888][T29898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 941.737912][T29898] Call Trace: [ 941.741175][T29898] dump_stack+0x1b0/0x21e [ 941.745482][T29898] ? devkmsg_release+0x11c/0x11c [ 941.750400][T29898] ? show_regs_print_info+0x12/0x12 [ 941.755573][T29898] ? get_random_u32+0x112/0x210 [ 941.760391][T29898] ? kasan_init_slab_obj+0x20/0x30 [ 941.765476][T29898] ? new_slab+0x21c/0x450 [ 941.769786][T29898] should_fail+0x6fb/0x860 [ 941.774217][T29898] ? setup_fault_attr+0x2b0/0x2b0 [ 941.779221][T29898] ? eth_get_headlen+0x240/0x240 [ 941.784143][T29898] ? iov_iter_advance+0x707/0xee0 [ 941.789155][T29898] ? __napi_alloc_skb+0xd6/0x520 [ 941.794078][T29898] should_failslab+0x5/0x20 [ 941.798567][T29898] kmem_cache_alloc+0x36/0x250 [ 941.803300][T29898] __napi_alloc_skb+0xd6/0x520 [ 941.808036][T29898] napi_get_frags+0x5c/0x100 [ 941.812596][T29898] tun_get_user+0x9ce/0x3400 [ 941.817157][T29898] ? __perf_event_task_sched_out+0x1127/0x1250 [ 941.823277][T29898] ? tun_do_read+0x1f10/0x1f10 [ 941.828009][T29898] ? __perf_event_task_sched_in+0x4ed/0x550 [ 941.833873][T29898] ? trace_event_raw_event_sched_switch+0x480/0x480 [ 941.840429][T29898] ? __rcu_read_lock+0x50/0x50 [ 941.845161][T29898] ? find_next_bit+0xf7/0x120 [ 941.849802][T29898] ? finish_task_switch+0x2be/0x4c0 [ 941.854966][T29898] tun_chr_write_iter+0x121/0x1a0 [ 941.859957][T29898] __vfs_write+0x579/0x700 [ 941.864340][T29898] ? __kernel_write+0x340/0x340 [ 941.869158][T29898] ? pipe_wait+0x1c9/0x280 [ 941.873560][T29898] ? pipe_double_lock+0x1a0/0x1a0 [ 941.878552][T29898] __kernel_write+0x12c/0x340 [ 941.883232][T29898] write_pipe_buf+0x148/0x1d0 [ 941.887876][T29898] ? default_file_splice_write+0x240/0x240 [ 941.893647][T29898] __splice_from_pipe+0x2d3/0x870 [ 941.898639][T29898] ? default_file_splice_write+0x240/0x240 [ 941.904411][T29898] default_file_splice_write+0x179/0x240 [ 941.910009][T29898] ? default_file_splice_read+0x920/0x920 [ 941.915702][T29898] ? avc_policy_seqno+0x17/0x70 [ 941.920542][T29898] ? security_file_permission+0x128/0x300 [ 941.926225][T29898] ? default_file_splice_read+0x920/0x920 [ 941.931910][T29898] __se_sys_splice+0x860/0x1b90 [ 941.936728][T29898] ? security_file_permission+0x128/0x300 [ 941.942414][T29898] ? fput_many+0x42/0x1a0 [ 941.946725][T29898] ? ksys_write+0x237/0x2a0 [ 941.951200][T29898] ? __x64_sys_splice+0xf0/0xf0 [ 941.956029][T29898] ? __x64_sys_splice+0x1d/0xf0 [ 941.960858][T29898] do_syscall_64+0xcb/0x150 [ 941.965330][T29898] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 941.971240][T29898] RIP: 0033:0x45d5b9 [ 941.975104][T29898] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 941.994679][T29898] RSP: 002b:00007f46bb9b3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:55:56 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b800800", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 942.003063][T29898] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 942.011013][T29898] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 942.018954][T29898] RBP: 00007f46bb9b3ca0 R08: 0000000000018100 R09: 0000000000000000 [ 942.026947][T29898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000034 [ 942.034895][T29898] R13: 00007ffebf76999f R14: 00007f46bb9b49c0 R15: 000000000118cfec 22:55:56 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 942.082003][T29902] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:56 executing program 4: r0 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x40) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x728df551}) r1 = socket$unix(0x1, 0x2, 0x0) utime(&(0x7f0000000080)='./bus\x00', &(0x7f00000000c0)={0x4, 0x2}) r2 = fcntl$dupfd(r1, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) clock_nanosleep(0x6, 0x0, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)) seccomp$SECCOMP_GET_NOTIF_SIZES(0x3, 0x0, &(0x7f0000000040)) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000000000f0ffffff0f000004000000000000000200000000000000192e48c27f8dc5addce8c025e0f8cd8dda45afcd53b5352d26a2eecdc567fc1e7f187c1225c13351a3103823d662eedf8c5677414e9ef6f18768fbdd6e18e60993b34983f82550af35a23c610d4066b30808fc4f3b87b25458b70d44f61fc34dfff96ae1ffde6bfe8b529c73998cb4cf081765dc03ca4b231088f304c4e4701939b06ec83e35d5e850dc18e9f0758ccb6927fd9aa8e014b25cadf1d39c89a03d024783b23a4ed2b9bd29a5e37a25365a77a11930b4d5d3fab45fe9fc28b36019c8bdfe41fadbd54ce186f2b5eecd6d81ff5ba51ce63573fe661115c590186b99bf9d1d40c1cc18a4b7b51e168439877580e017e50737e1ea97ad90ca3504655604f27ab49f9f24bee1457264fd0d273757a0cba46cb26e252e4a79ccf7"]) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, 0x0, 0x200, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x28, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e22}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) 22:55:57 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000000140, 0x172f, 0x502, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f00000001c0)={0x2c, &(0x7f0000000080)={0x0, 0x0, 0xb0, {0xb0, 0x0, "942900c4d45be132ce3f41fad212d4c651aece4719e75e5dd971cb8dc5208e362d9104d126d464f3cd0cc35bda86ead90710bdeeb2260e457ed0de15b16e45cb1a47934f7469e4060e77dacea599e62893dcef5ea1657d3ebcfbc7850eef2eed306ce832b0ba635dc967891420a177b4fafb1ef968bf14acb00b1f416f77c0c0d28cabdaf2f465aa62b6d5334c6b802af676484ffffc586125f93452971c8e3e32378397a75d4fcab6fa5507e4ab"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) 22:55:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b800800", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 942.214791][T29917] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:57 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet_udp(0x2, 0x2, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r3, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = dup(r4) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) write$binfmt_misc(r0, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x18100, 0x0) 22:55:57 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x2, 0x0, @empty}, 0x1c) 22:55:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b800800", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:57 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x2}, 0x2}], 0x1, 0x2, 0x0) [ 942.445556][ T4421] usb 5-1: new high-speed USB device number 70 using dummy_hcd 22:55:57 executing program 0 (fault-call:12 fault-nth:53): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 942.518699][T29928] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:57 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x3, 0x0, @empty}, 0x1c) 22:55:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80080001", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:55:57 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4, 0x0, @empty}, 0x1c) [ 942.620980][T29938] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 22:55:57 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x5, 0x0, @empty}, 0x1c) 22:55:57 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80080001", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 942.773366][T29947] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 942.805575][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 942.816844][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 942.826866][ T4421] usb 5-1: New USB device found, idVendor=172f, idProduct=0502, bcdDevice= 0.40 [ 942.836192][ T4421] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 942.844833][ T4421] usb 5-1: config 0 descriptor?? [ 943.185499][ T4421] usbhid 5-1:0.0: can't add hid device: -71 [ 943.191495][ T4421] usbhid: probe of 5-1:0.0 failed with error -71 [ 943.199527][ T4421] usb 5-1: USB disconnect, device number 70 [ 943.655483][ T4421] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 944.015485][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 944.026673][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 944.037127][ T4421] usb 5-1: New USB device found, idVendor=172f, idProduct=0502, bcdDevice= 0.40 [ 944.046796][ T4421] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 944.056312][ T4421] usb 5-1: config 0 descriptor?? [ 944.526267][ T4421] waltop 0003:172F:0502.0039: unknown main item tag 0x0 [ 944.533772][ T4421] waltop 0003:172F:0502.0039: hidraw0: USB HID v0.00 Device [HID 172f:0502] on usb-dummy_hcd.4-1/input0 [ 944.726438][ T4421] usb 5-1: USB disconnect, device number 71 [ 945.495347][ T4421] usb 5-1: new high-speed USB device number 72 using dummy_hcd [ 945.855385][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 945.866398][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 945.876824][ T4421] usb 5-1: New USB device found, idVendor=172f, idProduct=0502, bcdDevice= 0.40 [ 945.886180][ T4421] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.894836][ T4421] usb 5-1: config 0 descriptor?? 22:56:00 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x4}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000003200)=[{{&(0x7f00000003c0)=@in6={0xa, 0x0, 0x0, @ipv4={[], [], @private}}, 0x80, &(0x7f0000000140)=[{0x0}, {&(0x7f0000000500)=""/225, 0xe1}], 0x2, &(0x7f0000000600)=""/136, 0x88}, 0x3}, {{&(0x7f0000000780)=@sco, 0x80, &(0x7f0000001b00)=[{&(0x7f0000000240)=""/34, 0x22}, {&(0x7f0000000800)=""/103, 0x67}, {0x0}, {&(0x7f0000000940)=""/137, 0x89}, {&(0x7f0000000a00)=""/4096, 0x1000}], 0x5}}, {{&(0x7f0000001a80)=@l2tp6={0xa, 0x0, 0x0, @mcast2}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000001e40)=""/183, 0xb7}, 0x2}, {{&(0x7f0000001f40)=@tipc=@id, 0x80, &(0x7f0000003180)=[{&(0x7f0000001fc0)=""/86, 0x56}, {&(0x7f0000002040)=""/54, 0x36}, {&(0x7f0000002080)=""/173, 0xad}, {&(0x7f0000002180)=""/4096, 0x1000}], 0x4}}], 0x4, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$MON_IOCQ_URB_LEN(r2, 0x9201) setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000340)="dbdef20defa3989e4c8bc39bba669cb380e941a8481903b1ea83dc7ebd42fe33d0597b1f4273313fb7adec9bc5b48d381aad23fa6e851e921a7f8b11f5c7f214ff2d42b19e7a58", 0x47) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x1, 0x3ff, 0x3}, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000040), 0x7}, 0x0, 0x1f, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/partitions\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') clone(0x50000103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) connect$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x12, 0x0, 0x1, 0x1, 0x6, @multicast}, 0x14) 22:56:00 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b80080001", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:00 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x6, 0x0, @empty}, 0x1c) 22:56:00 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x3}, 0x2}], 0x1, 0x2, 0x0) 22:56:00 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x18100, 0x0) 22:56:00 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:00 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x7, 0x0, @empty}, 0x1c) [ 946.089923][T29977] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 946.125428][ T4421] usbhid 5-1:0.0: can't add hid device: -71 [ 946.131619][ T4421] usbhid: probe of 5-1:0.0 failed with error -71 [ 946.140614][ T4421] usb 5-1: USB disconnect, device number 72 22:56:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x8, 0x0, @empty}, 0x1c) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x9, 0x0, @empty}, 0x1c) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xa, 0x0, @empty}, 0x1c) 22:56:01 executing program 4: sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400), 0xc, 0x0}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x0, 'veth0_vlan\x00', {0x4}, 0x4}) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x10, 0x4, 0x4, 0x4, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000340), &(0x7f0000000400)}, 0x20) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x400000077fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 946.427744][T29998] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:01 executing program 4: sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400), 0xc, 0x0}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x0, 'veth0_vlan\x00', {0x4}, 0x4}) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x10, 0x4, 0x4, 0x4, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000340), &(0x7f0000000400)}, 0x20) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x400000077fffb, 0x0, 0x820000, 0x0}, 0x2c) 22:56:01 executing program 4: sendmsg$TIPC_CMD_SET_LINK_WINDOW(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400), 0xc, 0x0}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x0, 'veth0_vlan\x00', {0x4}, 0x4}) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)={0x10, 0x4, 0x4, 0x4, 0x0, 0x1, 0x0, [0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000180)={r0, &(0x7f0000000340), &(0x7f0000000400)}, 0x20) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x400000077fffb, 0x0, 0x820000, 0x0}, 0x2c) 22:56:01 executing program 4: mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x400002200006007, 0x0) r0 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) unshare(0x44000600) ioctl$CHAR_RAW_PG(r0, 0x401870cb, 0x0) accept(r0, 0x0, &(0x7f0000000140)) r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x20000, 0x80) fsetxattr$trusted_overlay_redirect(r1, &(0x7f0000000080)='trusted.overlay.redirect\x00', &(0x7f0000000100)='./file0\x00', 0x8, 0x3) 22:56:01 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4}, 0x2}], 0x1, 0x2, 0x0) 22:56:01 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x18100, 0x0) 22:56:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xfc, 0x0, @empty}, 0x1c) 22:56:01 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18102, 0x0) 22:56:01 executing program 4: r0 = syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f00000003c0)='./file1\x00', 0x3f63, 0x1, &(0x7f0000000300)=[{&(0x7f0000000140)="040005000000000000001c00040409000200027400f801", 0x17}], 0x0, &(0x7f0000000080)=ANY=[]) sendmsg$IPSET_CMD_PROTOCOL(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x1, 0x6, 0x201, 0x0, 0x0, {0x5, 0x0, 0x3}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x4040) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCADD6RD(r1, 0x89f9, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x2f, 0xff, 0x9, 0xfffffffd, 0x24, @remote, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7800, 0x40, 0x9, 0x1}}) ioctl$USBDEVFS_RELEASEINTERFACE(r0, 0x80045510, &(0x7f0000000240)) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x300, 0x0, @empty}, 0x1c) [ 946.912881][T30032] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x500, 0x0, @empty}, 0x1c) [ 947.066160][T30048] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:01 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x600, 0x0, @empty}, 0x1c) 22:56:01 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:02 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x700, 0x0, @empty}, 0x1c) 22:56:02 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x8}, 0x2}], 0x1, 0x2, 0x0) 22:56:02 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x18100, 0x0) 22:56:02 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18103, 0x0) 22:56:02 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x900, 0x0, @empty}, 0x1c) 22:56:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:02 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) waitid(0x0, 0xffffffffffffffff, &(0x7f0000000300), 0x1, &(0x7f0000000380)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="20000000100001"], 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x800) sendmsg$nl_xfrm(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@getsa={0x28, 0x12, 0x8, 0x0, 0x0, {@in6=@remote, 0x0, 0x0, 0xff}}, 0x28}, 0x8}, 0x0) 22:56:02 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xa00, 0x0, @empty}, 0x1c) 22:56:02 executing program 4: mkdir(&(0x7f0000000200)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x148) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000400)='overlay\x00', 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="6c6f7765726469723d6275732c776f726b6469723d2e2f66696c65312c75707065726469723d2e2f66696c6530fa1d987cfc2fa03e8e62fea85b7dfb3f75909b378744d119ab135d974d661b656b65c8c521e8e2f5fad6edafc479d92b5ce5e49ee6ecff65f0a1b5"]) chdir(&(0x7f0000000140)='./bus\x00') r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000440)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_IOCTL(r1, &(0x7f0000000180)={0x20, 0x0, r2, {0x8000, 0x4, 0xffffff08, 0x4}}, 0x20) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setreuid(0x0, r5) open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) 22:56:02 executing program 4: unshare(0x64040600) prctl$PR_SET_NAME(0xf, &(0x7f0000000080)=')\x00') socket$nl_generic(0x10, 0x3, 0x10) io_setup(0x8, &(0x7f0000000000)=0x0) r1 = eventfd2(0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) io_submit(r0, 0x1, &(0x7f0000000040)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x1, r1}]) syz_genetlink_get_family_id$gtp(0x0) 22:56:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 947.858627][T30082] overlayfs: failed to resolve './file0|/>b[}?u7D]Mfeke!y+e': -2 22:56:02 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4000, 0x0, @empty}, 0x1c) 22:56:02 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:03 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xa}, 0x2}], 0x1, 0x2, 0x0) 22:56:03 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 22:56:03 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x80fe, 0x0, @empty}, 0x1c) 22:56:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:03 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18105, 0x0) 22:56:03 executing program 4: syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "060101", 0x2, 0x2c, 0x0, @remote, @local, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, &(0x7f0000000000)={0x4, 0xa4, 0x65, 0x53e3, 0x80, 0x7}) 22:56:03 executing program 4: syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0, 0x0) r0 = socket(0x10, 0x2, 0x0) r1 = socket(0x10, 0x2, 0x0) r2 = dup2(r1, r0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040)=ANY=[], 0xfea7) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x10012, r3, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x5452, &(0x7f0000000000)) 22:56:03 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup(r0) r2 = dup3(r1, r1, 0x0) r3 = socket(0x11, 0x800000003, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) bind(r4, &(0x7f0000000200)=@generic={0x8, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0x51d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x8}}}, 0x24}}, 0x0) ioctl$sock_SIOCADDRT(r2, 0x890b, &(0x7f0000000140)={0x0, @can={0x1d, r5}, @llc={0x1a, 0x335, 0x1, 0x8, 0xfc, 0x9}, @llc={0x1a, 0xffff, 0x2, 0x7f, 0xe1, 0x6, @local}, 0x8001, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)='netdevsim0\x00', 0x5, 0xffffffff00000001, 0x101}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r7 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r8, 0x407, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x400400, 0x18) ioctl$TCSETSW(r8, 0x5403, &(0x7f0000000000)={0x6, 0xffffffff, 0x8, 0x7fff, 0xb, "def97499f286608167e52001e108b715e9139d"}) r9 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) write(r7, &(0x7f0000001400)="bb8f9f640903127a53527c6fbfe65d43b0e0586f2d40c7e7df58cac83420e83662d6e39bb6d5430622431454eedeeaee423d8f210bc3525fa7927c18d5fbc91ab13c2041136047d8da9375934d00f325499bfe7712208d387d41c31821c2a22d1325b556528e9b790b74053d1ed631c6ec8126d37c87216173138c00cef396868029af5b76bebac5e38b74d8bbc6ae66b6e202b6d505710377710ea7d43edf00e1a4c1c670bb4c263ce777da81abdd5ba5a5c82f67232f9b4d6f21b2e6afa8b38e4642b0daa2acbc0478d89b88e8b2094d4248855e5e81992e60be3afff0f3c3799350615489a901a659abdeca0c615a622ebf64175f990320e0356d4a11ed62eff72b709c23dd65942e8b534d7d775d370c1e435654a2634e6ee3649c4c3bcbe39e866f1eb9972af1a9cef42e701798a53dc92a242aadbac343e1765cf8ea5665e22deda69777e52b1e9e5d3edc022256939e1eee013448294911139d5b9c6241049fecdf9b31f4cdf6cff65d71b5071ef70e1798347c8846aa5b905e83050e3e606986ed3f603d18c5cdeb11cda1ce3abddea9376231af130e19fc7601ec1ab8cb5a7de9e2174547f18225b09a54fc8720dbb91eb69c1be88e601c3c9df4f2758f39a5151951b9c6dbb419ffd783a34c9fad10f201b8724d31865e2fc1fcf48db2be713053b43a0e3943c1e2b08e8a26e946c439d891db2a80b5ffa054bc8d0177d3214056250c61a537d2ec7630fb90395df2cd6aa9c5e573365db580520bdc3f1c6b2be992e1516a4b810a11935dc780699e461d9715f70c6d103ff49bf168f3cff4c0d0d6ba5671fcd2975450b0e1a3474139cb0f2d3476fcd87a8bccbeb2f5f8a821017b879aa5b9d1fafa9f4c429a74cd2da782114d97bf031746a817dd0293c4eddc3a9ecb5afe496f4971474ccd827449409f07cf94dda2e7dbe8520b5afff10a7e3b0b4289a167fc692635b5b7426d9e771b95860b09a3e752c867213c772e48ba30a78feecc7ff26e63e1749c62b52d377ac5cc52db830c965e04ccfcfb24ceacc69cfdc2094124dd27b2d68f699476a2562bab1de117ffc2b0702ee8b0b77f85fecec3a25b37ab7eb06232c9a73b4470f1727c82581d81942abf42d3ea37957927ad3dbd0ebe46678a9f4d25c47acaac83c14210a54b71fed40df017e2be27f01e3e6ea3ea381ca14efd202858e6535ad4f79a8cdf47e385b740a70c14e3651731a45cc0ca4a56f2e903cad0384efcc364caf67e09551d35c682ebc90a9286c4d274ba1b8ced742ede4e55a62db7ef9a96fde2add05b41599fd72a79ba280cc125cb266ef21b7eeafe3ee6aa78eef33fc66454549c3ec298cb683a55a32208cf6ce88b560166159d59e65f30540f62c5437652ea7f2a02f87ca242dd2250f58e75938a9a3ded51ae6598c2aba53287ff5cdaab17be7f4310f8e07e310d52778de79e1c2e4391b254be38910aa1cf6e1ca0e75d24be97d59f7025f16c6fbd549529b74e319c58f50438765ef0e3dc394eeb75dec41b3d80435b17520c97f5cd7ee692fb86d188fb0089fbf737dc1b96b9cc49be23a38a8cd92e5075f349993d7866369dd25eccbe1481477a05fee14e0edd1617921d7fcaa8fdc642e63b64388fa5b63442ff1466b1938d02546750b01ed9c980282ccbe10f204741249aed88c555ed6fdf7f68af9209807a71bbf4f31bef5a4223466da74ba8b034df529aef6ec6610a0d25973961e50e02af22d0ca8be1b9804a5918acbdb536e8f2f441ec9d640ed15133ee747440c86fc4526c9195954528673d25c8390170f3c19cb0b0c30b9e634c7ebae96946ae97c19eabca92226da925d22be37abbe0740938ea899ec42fd529a3b1063981e4c154219df5cf5af60a29b5a8ee530905725a14b28900eae937e705401ba8f632a7bca00d9724a992afdc9ed14aac71b8e3a7ee5ca095888feb195b4e083c3b611a1c2f8d092febe3b9f5f0df61e8d3c31a643c935b76bc1ad4265164e755484beb06610510bc51e8c6da8d71123bbe83a5e4128f41cf5c486d6a60496c300c406f990bee485cbdef794f2663ee66d2b18d8e55210c25c04b1a0c6d9c5f904e72806d2d4f5e5439bcdf146343cdffe4d0d70d42a9959cff9bd50c37cd478b0b0add16aae4dc839b46bca2ac7547144b6a422aed5e2db661bcb31a82bc0fc678e71a6cb090ef772860f3008b4152b5d281033be4a77b367baec3ab8ce7c83c601b11c8199bafcd15161a5454a6a982dbc3c2e3a5172b6a63e4904817075754eccbb0188c9cb2e5da9600f567485014887463b40f189b7ec3c5c0f36d502509e402c285765c78417ce6b3aab130ee79622dcd8ada842233e73a14554ee5e4995e32b3fe4075e247eb9bdeef64d1a7436c9b5782fb2f84f74e4c6e976289729c37b5bb8200a9480d181a6b11f5ec229b818134b8334967ae935ac1d81be4776fae4cb68b6fa330e93bd8de388b38455d569159bcd166df030a6dfedf28caf4608de7243f5df2c76f6680c301d819dc67d24d2f780432a931700a253b0a5b075195c6dbfd1fe17a1c11a3dffa872a07b877adc66d069fffb6d8326e1998c5a337c3d530250cae335ceffcf81dc438a47e73490d050a053813dbe6674e42c91ae94b4a88144f36adc1b08b4bcd6ddf4058c4e08d4dc83d5fbd843ee27eaf50b297c220350260d9abbeeb6deb921e50cae0ea590cfb6f00fb3c71520f565bb769705e2481ef27cf537d29f163c9fe3d39ed9fd18dc8b0c976cd302283e430807a9d751357f89092532d89fe280c69ad36e3541b5da9dea13fd19d0434c760fe295dfd9b9e63453c7853914c50b1b77ccd4b33c8b1f31fcb1aec040ffe2f9d728d8ea84297bac2e22230ebd1488c503b05b2e433cc37ce9fc123b7d3eb244b4549e9a841e73b664c8f6621ea5a4c9ff9c1da032255311f2c063a682baf4c97e7ba552bf71af4bd64f43872b846d15c65c487089be272cfa24a33f8c50930ea0bc4b089505fb8e97ded0e7e64a5ce897da6b940df4c3dddb8b4871d773f6ebf02058518c55c19aadb0f266caf18777ae68d2bfcfb2225961fcd10538ba664fd053a443320072707533ab761b9397bd0559126b84fe9196463ae50633017ea2d80940311d9c867102b1017f34af1965d8eb61be616a0d40656e2bbb750aee6f74f788c8acb2578e8686f5f8da6a19e979c152b7ee7c7f16902120588e2ff630144b5f929ffc593e946d9717c5968aa16c2d73d689fb5cce117acda3e23e5e0116de1cb6bddfa1a84cefb22c1e2c3753017696f27b9aec5d44f15411247643b84dd4410e784b4eb5b9c68fea671976f9b51c6526e2ddb40659611b0b3bcc7e249c77396fdb8c864ea9318f9de7fd3936fcbdc732c2f8b9556ec9afeb15d5e2df890351d66074d53dddc6e8dba8c91d733623ac95a49eb69c7de37ff2364ccddb01f6500750a012c2acf32a9f6bbd9e92d17ef858fbc34575db414ea42ad87a65b11ae5506469db256c421328f45aec73bdf18562447dc2840bbe9fc84dedd0fe6276fa174f21210d40193530ec7a70a9e60bfd6b00cba4d483be59950f16fa0dbd089b5fd0bb078badfcf42270cc62fe37be22b0d81f755263d74636fa466d2574ca62b58c649936d21e949de73ea45df3acade6609413f56fc218d6f11947bf1fd629d38d8acce90ee3c1a51117601ae126bec537e3e76ce7ecc53cfeefee8aaa104aa853a65aadf27bac9849ee0122793b11cd8e4f32fb07afa39e439cb738c30a6df958160aac15c26032a61aaf614b2e6601581fb0ab8d115e045005dee3df8ea42643cbcbb0b111130c42c94b7e874cfee50d5c2eb13b3a38c417fce9d740b7d43120431a7d44bc3934ee87b112401cbee3553837b6a0b4b3faaceb46eca4064301c8060870350e256ac9d5557f674536b9d9717a82fa211e7dfb52ca410d8a4f2f6b733c2a082f247538a6c40f56cf64204e62515db692f32733ff6f4b0787ef305d5e80881375467ae603ac3600e688c42f89a4fea4fdda09a8d59e19457c654a98c8129a8c65bae3310af2b170729e18400c915d0a2f4c4fc51747846630b95ec181228bda7ef48ad389815aa82de6c4a3b0746c28c01f9ec697ff17f095e1cf9d2fe78fdab9cbb1ca7aefc8af6a0cd98444735fad79e394a8f9c2fd358c3cde4ca6d57a620d0bb52dc6ff93f034b596f407c21511cc2c5ec8b0ede7f5c0acca61939ac7f2cad820c15133e69507eaa739e9a88936f4a74f0ad1574a1591f31f582a76157d89805cb3ba5e8d10509bf7a08e928653b4f05ba797a06765b74c8759fc34178624c08a2b99e59bcff5d33af2b0f9176b56c35f4da31c751a4c2fd88a1997cd9fc9bbf78220731d4c8cea23be1fd29c36b34d8458b7021ebcfafdc7e54096e517da3eb684298f742532d776164d9c9658e5faca0a3b08afca1bc27ed357884f49fe51bd0c38057f4288f1917e36e3865310b5eed140aef6150ae363293cf7467abd5e06cd7af5e2c49e7c5253a1155741e380bccb023a0faed93d9a64512d72436f1ef4ac0904a413e45164c23413bd57274a0a951c41a9a43aed094d4ea5c480ce64663cc9d36723179e2b19a48e9277a6591bbd888a06e0f2f142cd4495be4ba7274d69ba32a2788b935b2f18c5f336cb9de062829e2e0bb476efb36c3f53a766c14314f31637a464ac59d378ad7f51bef8d88715613653a427038e0d3e4dc3948bb1d70eb55c91c92f7510b1c0387253b458d2c90d17238f9eb239c680179a6c1e0759be367963e3b4d7395fd3911626582a094e6a8d0e746242f94267a4c57d5b2360ce3a6f7f3e3c10e124a54ed24d1585bc7b731cf731c94ee00ebf070b999b9bf28d76bfec9dcf12fcce2b9c4444c706ec6b943b5f39e9151a764ba1cd0cd6c1c7cdc3aa824cf17da705be27a18fbee41be39d6ae4dd4312f5f4bfee2c5bb21d941666f9d79b0f80c9b1bace84a05d2b0e3be1c3fd04d72b4b0124595c435813969d413960fddc858730a433383f3bc0472cb7683ea569e001f00"/3584, 0xe00) fallocate(r7, 0x11, 0x0, 0x10000) sendfile(r7, r9, 0x0, 0x11f08) 22:56:03 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xfc00, 0x0, @empty}, 0x1c) 22:56:03 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:03 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xfe80, 0x0, @empty}, 0x1c) 22:56:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x20, 0x2, 0x2, 0x101, 0x0, 0x0, {}, [@CTA_EXPECT_HELP_NAME={0xa, 0x6, 'H.245\x00'}]}, 0x20}}, 0x4000000) 22:56:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xf}, 0x2}], 0x1, 0x2, 0x0) 22:56:04 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 22:56:04 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b702000003070000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d64050000000000650404000100000004040000f5067d60b7030000000000006a0a00fe18000000850000002b000000b70000000000000095000000000000000d7a28073a82f5e4aeb54e36633e27c279341bf489903cfdb4c05e96e3046f04e77949c306340ee6af0d499a0d063518598e7e290b39f2fc2a5e019bc6b45684f002cf57bf887e83fbb2215b8a34e6bdc4dc1af6d3c6958da4bddac602db05ba8157ea08246ae09376e0048bec11e874602f060000002af21b753af0a0cc85ae281993bfa2139a3bb755c1f1abd1964007000000e27b2121a5f03dff9787dfd6e7608eb638e6fc4e0bc6bd5ff35928a5b5fa723028eb6ddd35ea79b92beeb52265a4b04ba50fd46a504116fb8ef84c2be021a6c9daf3f24ad7b965af8f522371c9a43c80ee6b397bea247e2d714090d43fe66bbf4f4ffe410bd701d035f867de2a20695033d91ee238c824e0b7a0aeffb9843947c3bc96e1f95c245168d2aeed2e00463d9c039bfdd58709e898c7ebad73fc48673c75c8b50db852621ad19c854622f7c7d79ec3ab4494353b458c718021442bbc6456bf0c9f6b822211eb1aa488fcaebb109382c7ab6db9c100f24e466494e7b8549cc139a74b5aaaf261f35e8347eaabe01afe21d7b7a958e9cd04b5bfa5cf78dd2fa958dbb605cd1a99613369185b2bcfe0bf0e31c83fdcb254da7cd3b68983d0798b455c8c5a5a8565d83d28437895929fa0896cf45eda77c4feae29d96568c487a74dd4f9e8465f09818c12dfc93fdb09a1d04a087d3bf219efab764d3cd676f101d3b6c9177c57340b245f15af472f1b837081969db2d58ceab0b432005a86e6c450ae4241c08a6469ac65af64737af961cc90132cd2ccb6d7adf63846af1554cfcaa4eb357142a5b525a18d9d88d42520c0903bc444dc0eec4d26e586eff7c436cd12be4c796f9ebe4481f971c52a8cc7b0edab7ae8185bb7cd1fb78ff9e194e17c65acd8d015443a21815bf56f08f1d2293ced278899a972056380b4f343d39737b149e16b060000005d362cde82509ead9932869d3d9b3e87d56ac5c41f4d711c8b3e1d294b18ba6619bf4b5568a0a16c018ce2a24832b0db18bec414d78f886d1ebf7300384b13efefa03ad55fbaefc026eaa571d5deb4495ebd6fc7d457af008e74855562bbb4f255c5a6819ae0ccfdd7403d13938b4bae98b98b621c309b18df38a1cd779bf479096c09851c1f2e1765212094ffb97ebf972e48871f76b5e0cdfda81df28e5f721f8a63c0fbd8ac992d7535452f7af68f5ae22020afd0a6036d51cda98fef44b69139315832d49fef81198f15ebe3a7548ba46451d93da03b99becd85851e7157d7e23b2803358d060fc4fa989796900a9d76008d537275a8fb1d419408248ddc98113e884991726bf05401000000a5e0f6db373e438df8508198cb61a4640684d02f9f97cedee66fb92098eaa9ee8dedc0003731c511efcfa620075518635230b3467b92bf76b271bdab823dc284323acc4fc92e8fe452351272730702208f63ebf791adae9111d09727ed1d6fa159ee87aed74e5bfc1c93da96da4f3d0d8c03273b474bd194d2579541f86370d3f5258941be9285191261a6139090e32cd51089d136548ccdabfe1d2cc8e151cc6ecc1b91551eabca418e41289498d659f2ab89bbe5d40ed966b5ff74b12db521c36ce6c1daaafd9dca802bac19ed4e704d2a99092098493764662cc153f57deaff4f68ae76f30500000000000000b9b69f6ce477d6ee279bba72df0f04e22eb2650df6cde761917dea7c34e113ec765bb5fa0c71b8c2e25f001118fbc496a153a0d6e08a8f9117165e01044cb9fb0bb4026372effb9490290541a3930b38705e05758b90f8cf42b4886d417da85e8ab3c9efb8ad688491ba005eb7a798e935f7308ddbd001e478ccb308bc6596ccae90f5037c4dc020cf21bacc3cfa51db4e4ab6f92a355d4382802fdd9d746a1495489de7c21e3c6055d8a2dae048c10942fa9fe7a02dabf2c563dc4b81afa900000000d72299776a348fe7cce33e4138e7b26ab7630d407b82ee3ef340fb5794faf22c63c309ce6d3f0f292bee2f1172674fe921ae23008f352d85541c902f0a9209d558642ef490017d4f37e21a501dd5e39a5b0cfc9cb1b638459b65a2b2d5a7a5b95c87434ef38b4e0905e6347eee4c8c88d370433bc227749e1b870dd742d569da8d372d2af0f1fd3490dca52f4cb8bae142859e0650f3b958201491529569e27f3d7079f9df47af3eda8f7090d27826f61cee56063c23bae60d93a4a386c1ba82ba0b5778c717a20a99498be4f239d70b4789b9237df3ae59fcf96b68709257b5bc83e29738281a06bc2a4dcd6a21deecb2440166b74a617dbfeaaf17bc57f2967650f6dd757b803408ce3ede97303e626b42966b613fb6692000dace36b2977edee0847182dacf6f543185be2cbf90030c41c260b2d0057748c9f1650d6a5c692b1c62112f65b2c713a02b9ed0f28b22cafa1cabf3270e230f1a8456295e078a6ee96ea37458817d0bc27cd0a3274a0cca3eb07b8c65cf474263a5c7"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r2, 0x5, 0xe, 0x4d2f, &(0x7f0000000080)="1c04ff01de6da9725f90c5a06d0f9f2400844d0044a98db225a47ecb10b429441dec77009050d9560e58f2e162226d4fe467a890b6c4c556c6894acf3d4cd49c4dd5a2d05d6ce642e3abc0e0cb0a7de568fb3f30013c74eb73383ebaf4257042ec5277fa18a9b201882996c7b8de5080c75756094ac8e258ff1673c27fb2f2bffc290edbc5dec9e44b6fab8d5fcbd12ae8339b04701b316bd5eccc3961ce80", 0x0, 0xf0, 0x0, 0x0, 0xfffffffffffffe19}, 0x28) 22:56:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="34000000100001080000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:04 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18108, 0x0) 22:56:04 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0xff00, 0x0, @empty}, 0x1c) 22:56:04 executing program 4: clone(0x80000500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ioctl$KDFONTOP_SET(0xffffffffffffffff, 0x4b72, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x1a8, 0x0}) wait4(0x0, 0x0, 0x80000000, 0x0) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0xa9) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x17) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = gettid() tkill(r3, 0x25) 22:56:04 executing program 4: r0 = openat$bsg(0xffffffffffffff9c, &(0x7f0000000000)='/dev/bsg\x00', 0x400402, 0x0) r1 = dup3(r0, r0, 0x0) write$vga_arbiter(r1, &(0x7f0000000040)=@other={'lock', ' ', 'none'}, 0xa) r2 = dup2(r0, r0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x47, &(0x7f00000000c0)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0x3e}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3}, @map={0x18, 0xa, 0x1, 0x0, r2}], {0x95, 0x0, 0x4000}}, &(0x7f0000000080)='GPL\x00', 0x7, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r0}, 0x78) 22:56:04 executing program 4: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r0, &(0x7f0000007240)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r3 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) openat$cgroup_subtree(r3, &(0x7f0000000200)='cgroup.subtree_control\x00', 0x2, 0x0) r5 = open(&(0x7f00000000c0)='./bus\x00', 0x400001, 0x0) r6 = creat(&(0x7f0000000640)='./bus\x00', 0x0) pwrite64(r6, &(0x7f0000000a40)="d0fdbc358f6a7c1332bf5548d7c8355584af72a8fc3fef02a93078013ca3570db6da806c967421597c2e574b54010104d79fd1e742be41a2735bad6759cc7fcbd2b29934e3331adc1be0464cf8dcec39cc800bf656622edb0e94a67e4706cba7a06a99d201b4f39bacb0d559a059c9f6ec7f4c3f5fbde940838675ce87f0c0a1382c900d4f1174115a1b6f05a054add3f514a30c3cb512bcb0147a94a32901fd446a79e43cd868147f21d8e424a70aec7b581897c777af367b6f8396a9f38914e3c4e5bed15cccfea1f1952036c76864542f753501a6b7eb4b90d8652504fd7e0420cac62249ae43693f3ad0854eee752dab69e4a81fa1f3f0edcc875d88ceb11c02bc8cb115e7d3ac30cf0f9b6d5130dd24b5fbabb44152528ccbad03f9860cb6a1b6139769331c7f2ed45ff18ede9f74c9ca8523623b7313c628867457ccc3a3e9cbd37b9694ae22ff60307e3d702a938c214626aa39e6b2d65f16d1a86813cb83df8ea9139c727691c7e40c24cb53458f86644f4c40db48d481567af0b093ed6533b00fb84def50348d7a40bdf56cda2485673015f9b12a2ab2e42fa9db4552052e13340cd14bc7e24fef39380d1d18da97a04b4a1ad1f24fd30ebcd8f3cb8b298f4297a5ab577dfc99bced3cedc377b8ad5a5938ee1ebff567d1586e89f067eb1e65eeb2fb658a71f79c9322cbc82a79c904134e949d3afcc5722fc84ce2379551386d9cda525abb59d9d6e9d9065703f8e58f15ae4281f758134027ceaffbd1507e50de2335b1bc56037076911b65ae5df8f316cccf3997cb1f534accbecaaf12ebf1cc90cef359be6bb90674179b3133a8d76235e9ce25f8dcabc9f3412750c1b1b0a2be6ca5071f37de07feedc23d2cdcce981545a3ee9204886432822dc6fc1cd870a6bc09a01fd6577bf58832bf4d766e505ac14afd9ce747c089c71e7359689a4af114917077aac01ce3a8c55efc857562e8dfe06e6096f505dfad87b2ac99543fe5c782c8a9736886cfe04bd868ef0081e62fddf3ca20adaedd26f007c6fc6bcd4a48392efa082506427e040af75a1a016fab7a04069ac6951f1032a45d05dc7c6214be12e0e9193ab5c83b502c18b01cd256c2de5202cc60febdca3cc2c9425b134f3417178edba98c23df7107512508c96ec689217c086df4953b2f748042a159360f7368506d42bff96a3393ba0b93c080bcbfe01cf488b8901a58bde4bebe35e1199e35934afdf9d166dd4b6d65f1f510f970b522306513b48f7851c34502b59573774d83926603a64bf84b1f7e14e4b9823226942d243e9872fe92c90c03fe7dc0ab2d1a24b8eb1c5440ba8012d330a4ebf1864953282fae2ca5eca59811d45e70a8536dbbc158253d0e16fce6951a2e9b031e23641919bd457e8877a74d7036646a6d0bdea21ab84a756ef611657f7473ec132ab2014b9484331d2c67eb4d378dc9f440d2d3b338eaca44a94ff74d556392219dc20d0541f1ca92c4be5c7450535b9b403fba24757578971b02317ad3449ce870fc6499f30efdd7f604206e54dfbd26b59fd4351f0e053488ced63f9333d4e69819ba25f78ebb6c0156e6e61b3c1599b705cd8f1093123d4cf96c01b7d871b175bb18acf5a3b65b9c4b8827a6cd4f742699c1817862ec7144da11d1ef2c3f96a1ce5f25ce555de43dec0fe3d812409de09ba23bd9c9a5a66a2c41eccca2b988d9e318fa126d16f16a23d140d5ac0b2865505116f2ec5981ba3eae57774d03acdbd1ed4385eb392aef6d8c5124cebbda759e59a24c7c93f4f7c8020ebb340051b5cb676a392ca4de0940037a10e4ea97d34696aa11f281b9938e4fcb2da5ee60ea45b2813beb976399e835bed01d0d06892492ed51195ab99245a58b51431d7c48ee1de0157d3b7403e94c79b3023fa40e763fe39efd0657f1f774cbe859e657ec4bbfe468c36c0a100430eafea614be00d2cf826047bbd41d1e293ca8fa8e186617048a5a4d55dc7fa80cbc35cff0ff8c1e473b8c66aa0881a415f7ed30efcc7c948e57bda8d76cb3e63448e062948f04e48e599002e917f0d1ac8f9f98f35c916954325531868a65296222056ad74dd2d7dde960f0b983575c18e23946622d59cb6306a56b3e1cc6bcf443cbef9b873e42d5948e7e3758a9045146d456f54f089addf1144a0f5c01fac67fcf67621a766eb684bf79e624f1dd70a765026b34eafc7644d6b6df2752a463ae3cd5f95b1bab9dd8be490293492e02635ad43b306aa23d4f33cfa1d260e0b6dcefbcb1295beb09d52a8bec31866868c0eda0156a5710c2d367d21b32bedd44ab59b24d262ac0fff7cf3308155a0852854e91c7b1800dd810742ad97f937992798f0495ce58203c79ffd2e471deb022e001d2b860fcf0b83a4a893da00da11369d6aa56a56b50caad66c2dc603b8926c77bb4482ca9bf0985e84b6eea6ed6b7c8cbb531aa625ff865c6686fd383d22a1afb771b4d08eb84d28d174c56cfe084bfaf89ba89c71a4cdc6991dc82f7d88ee3700a863c559d68a3eaec627545b8e72a5915f4d5ebaad5b7babaf1798842e7932189ef3cfe8f68c9f2d56b5147c21d4654702ad0843c1268313037996500fbdbfb3f81d42d09ef23c3f873f100d680273215aeb1cfc4448accc6c4989a62ef7110f00e66f5c2564302ce69f57289e278a4d838e8b0edbad3c6e88baec10ea872514812386bdc413ae36696a1fe90c723a35b9750d613fa2929cfe46bc53805e3bcad81debd750051f73b46e75a2a2ad6e24177c6d73bd3563850e12f98816dfbc2bd0142f02a353371d2cded656b74246e8f7248ff784169cca3208c0897135fc35ace98c266e952b21c44ef7b908e60e9ec77a76c50271039371fcdfae4d771f09e55371e5571098440fe8f692b206e46059a8a21e4f7f8a6d3035346f14787c24c72863f3fdd2be9414457a2eb65edfef9d6c113db78c8baab58c2ae60a4568cb69e839be742b7d36f4cfe565a44c6ca96c6c017039d7ea1fb511cf6521d557d2765b64badb559d5dc22c69361e2bed9730a84d4ac4715bce8f35ad3e231487a0f0c23e42732918aa50fdd5324bce5474aa32ee309b40083e5fae0cf00f421f7de8b02f313632df9cba1454c7b15f59f6dd6dccac64b2bdde36dcc50c2eb1876f8abced7990f3b2853839f0cdd2dc6ad10e42b02f02204667ae828f5b8f1c2b53541f356d788b694a623b3069a11a364592827b8fee0e925978e22a09e719032a14c7498248b719976d82c6e0e4eae1c4643c088e803d7cc61a139198ff39b238f3243492a69df4415bd7229fdba133df4", 0x929, 0x36d8) sendfile(r4, r5, 0x0, 0x80001d00c0d0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x38, 0x1, 0x0, 0x0, 0x3}, 0x0) [ 949.612761][T30143] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:04 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:04 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="34000000100001080000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 949.737279][T30171] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:04 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @empty}, 0x1c) 22:56:04 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x15}, 0x2}], 0x1, 0x2, 0x0) 22:56:05 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x0, 0x0) 22:56:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="34000000100001080000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:05 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x3, @empty}, 0x1c) 22:56:05 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x1810d, 0x0) 22:56:05 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x4, @empty}, 0x1c) 22:56:05 executing program 4: clone(0x4000000006ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='stat\x00') exit(0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000080)) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) fallocate(r1, 0xa, 0x5, 0x90000) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x200800, 0x0) sendfile(r2, r0, &(0x7f0000000100)=0x3, 0x4) [ 950.461932][T30186] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:05 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1e7d, 0x31ce, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[], 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000002c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="000006"], 0x0, 0x0, 0x0, 0x0}, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) 22:56:05 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x5, @empty}, 0x1c) 22:56:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 950.604915][T30209] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:05 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:05 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x6, @empty}, 0x1c) [ 950.695712][T30214] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 950.845059][ T4421] usb 5-1: new high-speed USB device number 73 using dummy_hcd 22:56:05 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x35}, 0x2}], 0x1, 0x2, 0x0) [ 951.095139][ T4421] usb 5-1: Using ep0 maxpacket: 32 [ 951.215095][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 951.226051][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 951.236612][ T4421] usb 5-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.40 [ 951.246011][ T4421] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 951.254569][ T4421] usb 5-1: config 0 descriptor?? 22:56:06 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:06 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x7, @empty}, 0x1c) 22:56:06 executing program 2 (fault-call:12 fault-nth:0): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:06 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x1810f, 0x0) [ 951.346064][T30230] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 951.391031][T30236] FAULT_INJECTION: forcing a failure. [ 951.391031][T30236] name failslab, interval 1, probability 0, space 0, times 0 [ 951.403666][T30236] CPU: 0 PID: 30236 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 951.413790][T30236] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 951.423830][T30236] Call Trace: [ 951.427102][T30236] dump_stack+0x1b0/0x21e [ 951.431464][T30236] ? devkmsg_release+0x11c/0x11c [ 951.436394][T30236] ? show_regs_print_info+0x12/0x12 [ 951.441586][T30236] ? stack_trace_save+0x111/0x1e0 [ 951.446609][T30236] ? stack_trace_snprint+0x150/0x150 [ 951.451983][T30236] ? stack_trace_save+0x111/0x1e0 [ 951.457083][T30236] should_fail+0x6fb/0x860 [ 951.461473][T30236] ? setup_fault_attr+0x2b0/0x2b0 [ 951.466477][T30236] ? avc_has_perm_noaudit+0x2fc/0x3f0 [ 951.471828][T30236] ? iov_iter_advance+0x707/0xee0 [ 951.476882][T30236] ? __napi_alloc_skb+0xd6/0x520 [ 951.481799][T30236] should_failslab+0x5/0x20 [ 951.486354][T30236] kmem_cache_alloc+0x36/0x250 [ 951.491089][T30236] __napi_alloc_skb+0xd6/0x520 [ 951.495830][T30236] ? do_syscall_64+0xcb/0x150 [ 951.500496][T30236] napi_get_frags+0x5c/0x100 [ 951.505072][T30236] tun_get_user+0x9ce/0x3400 [ 951.509632][T30236] ? memset+0x1f/0x40 [ 951.513589][T30236] ? tun_do_read+0x1f10/0x1f10 [ 951.518333][T30236] ? unwind_get_return_address_ptr+0x130/0x130 [ 951.524463][T30236] ? memset+0x1f/0x40 [ 951.528418][T30236] ? unwind_next_frame+0x1c07/0x22b0 [ 951.533671][T30236] ? __rcu_read_lock+0x50/0x50 [ 951.538404][T30236] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 951.544441][T30236] tun_chr_write_iter+0x121/0x1a0 [ 951.549479][T30236] __vfs_write+0x579/0x700 [ 951.553867][T30236] ? __kernel_write+0x340/0x340 [ 951.558684][T30236] ? __kernel_text_address+0x93/0x110 [ 951.564030][T30236] ? unwind_get_return_address+0x48/0x90 [ 951.569633][T30236] ? stack_trace_save+0x111/0x1e0 [ 951.574631][T30236] __kernel_write+0x12c/0x340 [ 951.579314][T30236] write_pipe_buf+0x148/0x1d0 [ 951.583966][T30236] ? splice_from_pipe_next+0x9c/0x440 [ 951.589305][T30236] ? default_file_splice_write+0x240/0x240 [ 951.595076][T30236] ? do_sys_open+0x60f/0x7a0 [ 951.599646][T30236] ? __rcu_read_lock+0x50/0x50 [ 951.604385][T30236] ? do_sys_open+0x32a/0x7a0 [ 951.608940][T30236] ? do_syscall_64+0xcb/0x150 [ 951.613590][T30236] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 951.619627][T30236] __splice_from_pipe+0x2d3/0x870 [ 951.624628][T30236] ? default_file_splice_write+0x240/0x240 [ 951.630426][T30236] default_file_splice_write+0x179/0x240 [ 951.636029][T30236] ? default_file_splice_read+0x920/0x920 [ 951.641716][T30236] ? avc_policy_seqno+0x17/0x70 [ 951.646535][T30236] ? security_file_permission+0x128/0x300 [ 951.652225][T30236] ? default_file_splice_read+0x920/0x920 [ 951.657911][T30236] __se_sys_splice+0x860/0x1b90 [ 951.662734][T30236] ? security_file_permission+0x128/0x300 [ 951.668431][T30236] ? fput_many+0x42/0x1a0 [ 951.672727][T30236] ? ksys_write+0x237/0x2a0 [ 951.677214][T30236] ? __x64_sys_splice+0xf0/0xf0 [ 951.682037][T30236] ? __x64_sys_splice+0x1d/0xf0 [ 951.686865][T30236] do_syscall_64+0xcb/0x150 [ 951.691346][T30236] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 951.697204][T30236] RIP: 0033:0x45d5b9 [ 951.701094][T30236] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 951.720676][T30236] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 951.729059][T30236] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 22:56:06 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x8, @empty}, 0x1c) 22:56:06 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x42}, 0x2}], 0x1, 0x2, 0x0) [ 951.737004][T30236] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 951.744943][T30236] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 951.752890][T30236] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 951.760847][T30236] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 951.855110][ T4421] usbhid 5-1:0.0: can't add hid device: -71 [ 951.861137][ T4421] usbhid: probe of 5-1:0.0 failed with error -71 [ 951.872022][ T4421] usb 5-1: USB disconnect, device number 73 [ 952.224992][ T4421] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 952.464963][ T4421] usb 5-1: Using ep0 maxpacket: 32 [ 952.585015][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 952.595905][ T4421] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 952.606593][ T4421] usb 5-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.40 [ 952.615966][ T4421] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 952.624456][ T4421] usb 5-1: config 0 descriptor?? [ 953.105712][ T4421] ryos 0003:1E7D:31CE.003A: unknown main item tag 0x0 [ 953.112572][ T4421] ryos 0003:1E7D:31CE.003A: unknown main item tag 0x0 [ 953.120653][ T4421] ryos 0003:1E7D:31CE.003A: unknown main item tag 0x0 [ 953.128142][ T4421] ryos 0003:1E7D:31CE.003A: unknown main item tag 0x0 [ 953.135666][ T4421] ryos 0003:1E7D:31CE.003A: unknown main item tag 0x0 [ 953.142946][ T4421] ryos 0003:1E7D:31CE.003A: hidraw0: USB HID v0.00 Device [HID 1e7d:31ce] on usb-dummy_hcd.4-1/input0 [ 953.306525][ T4421] usb 5-1: USB disconnect, device number 74 [ 954.074948][ T4047] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 954.314914][ T4047] usb 5-1: Using ep0 maxpacket: 32 22:56:09 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9, @empty}, 0x1c) 22:56:09 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/18, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:09 executing program 2 (fault-call:12 fault-nth:1): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:09 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18128, 0x0) [ 954.434924][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 954.445843][ T4047] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 954.456188][ T4047] usb 5-1: New USB device found, idVendor=1e7d, idProduct=31ce, bcdDevice= 0.40 [ 954.465514][ T4047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.474087][ T4047] usb 5-1: config 0 descriptor?? 22:56:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x48}, 0x2}], 0x1, 0x2, 0x0) 22:56:09 executing program 4: prctl$PR_GET_FPEXC(0xb, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x84400, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x800, 0x0, 0x103, 0x2, 0x8000, 0x100}, 0x20) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) prctl$PR_SET_FPEMU(0xa, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000000)={@mcast2, 0x800, 0x2}, 0x20) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x112) write$binfmt_script(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="0f02c96abdd6"], 0x8b) r1 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x0, 0x0, 0x2, 0x1, 0x1f, 0x0, 0x400000000}, 0x20) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) dup(r2) dup2(r0, r2) r3 = syz_open_procfs(0x0, &(0x7f00000004c0)='net/ip6_flowlabel\x00') sendfile(r1, r3, &(0x7f0000000240)=0x202, 0x4000000000dc) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000003740)='SMC_PNETID\x00') getrlimit(0x9, &(0x7f0000000040)) sendmsg$SMC_PNETID_FLUSH(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x24000815}, 0x4005) sendmsg$SMC_PNETID_ADD(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="ea0cda00", @ANYRES16=r4, @ANYBLOB="010026bd7000fedbdf25020000000900030073797a32000000000900010073797a31000000000900030073797a30000000000900010073797a31000000007c1361f4914724b5eb6a268f86da811d362cc968991e3412aaf9d5d34c290577269b89e07607f6959506aae59d5d381d3c53e5d8eb019793eb1ca17473dab815581a8c88914f9d095c98acab5071ef85b26302741cd612d658b599aab2685c6c3abebbb948d750d638dc78178d5d26aa8edb87583bd74333bb0244948017853bf52eec768bbd89cf6587be11196c193e0eca901fdb97cf572cc8db0d6254de6d43c4dd27afb9eafebdd30745711a74ff49578905129c86902733bffc8a1e00d8c08b082ce2864c87394cbdecdb07e7b07b86947cefd97b9dfa02296c330edf9dde34875fb42b5d7504cec503026093a9d8fd2e6edd08322b62c66e30"], 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x4) 22:56:09 executing program 4: pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f00000000c0)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0}) ioctl$BTRFS_IOC_RM_DEV_V2(r0, 0x5000943a, &(0x7f00000002c0)={{}, r1, 0x8, @inherit={0x58, &(0x7f0000000000)={0x0, 0x2, 0x1, 0x1122, {0x2, 0x5, 0xa000000000000000, 0x30, 0x7026}, [0x7, 0x401]}}, @subvolid=0x10000}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setitimer(0x1, 0x0, 0x0) [ 954.534917][ T4047] usb 5-1: can't set config #0, error -71 [ 954.542617][ T4047] usb 5-1: USB disconnect, device number 75 [ 954.550902][T30265] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:09 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xa, @empty}, 0x1c) [ 954.641342][T30282] syz-executor.4 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 954.652752][T30284] FAULT_INJECTION: forcing a failure. [ 954.652752][T30284] name failslab, interval 1, probability 0, space 0, times 0 [ 954.665469][T30284] CPU: 0 PID: 30284 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 954.675599][T30284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 954.685734][T30284] Call Trace: [ 954.688997][T30284] dump_stack+0x1b0/0x21e [ 954.693302][T30284] ? devkmsg_release+0x11c/0x11c [ 954.698212][T30284] ? show_regs_print_info+0x12/0x12 [ 954.703378][T30284] ? stack_trace_save+0x111/0x1e0 [ 954.708373][T30284] should_fail+0x6fb/0x860 [ 954.712757][T30284] ? setup_fault_attr+0x2b0/0x2b0 [ 954.717767][T30284] ? setup_fault_attr+0x2b0/0x2b0 [ 954.722761][T30284] ? avc_has_perm_noaudit+0x2fc/0x3f0 [ 954.728108][T30284] ? tun_get_user+0xc08/0x3400 [ 954.732840][T30284] should_failslab+0x5/0x20 [ 954.737309][T30284] __kmalloc_track_caller+0x5d/0x2b0 [ 954.742561][T30284] ? __napi_alloc_skb+0xd6/0x520 [ 954.747466][T30284] ? tun_get_user+0xc08/0x3400 [ 954.752236][T30284] pskb_expand_head+0x10d/0xfb0 [ 954.757058][T30284] tun_get_user+0xc08/0x3400 [ 954.761616][T30284] ? tun_do_read+0x1f10/0x1f10 [ 954.766346][T30284] ? unwind_get_return_address_ptr+0x130/0x130 [ 954.772469][T30284] ? memset+0x1f/0x40 [ 954.776420][T30284] ? unwind_next_frame+0x1c07/0x22b0 [ 954.781676][T30284] ? __rcu_read_lock+0x50/0x50 [ 954.786408][T30284] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 954.792443][T30284] tun_chr_write_iter+0x121/0x1a0 [ 954.797441][T30284] __vfs_write+0x579/0x700 [ 954.801827][T30284] ? __kernel_write+0x340/0x340 [ 954.806643][T30284] ? __kernel_text_address+0x93/0x110 [ 954.811988][T30284] ? unwind_get_return_address+0x48/0x90 [ 954.817607][T30284] ? stack_trace_save+0x111/0x1e0 [ 954.822619][T30284] __kernel_write+0x12c/0x340 [ 954.827271][T30284] write_pipe_buf+0x148/0x1d0 [ 954.831923][T30284] ? splice_from_pipe_next+0x9c/0x440 [ 954.837263][T30284] ? default_file_splice_write+0x240/0x240 [ 954.843036][T30284] ? do_sys_open+0x60f/0x7a0 [ 954.847620][T30284] ? __rcu_read_lock+0x50/0x50 [ 954.852359][T30284] ? do_sys_open+0x32a/0x7a0 [ 954.856922][T30284] ? do_syscall_64+0xcb/0x150 [ 954.861570][T30284] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 954.867613][T30284] __splice_from_pipe+0x2d3/0x870 [ 954.872625][T30284] ? default_file_splice_write+0x240/0x240 [ 954.878399][T30284] default_file_splice_write+0x179/0x240 [ 954.883998][T30284] ? default_file_splice_read+0x920/0x920 [ 954.889684][T30284] ? avc_policy_seqno+0x17/0x70 [ 954.894513][T30284] ? security_file_permission+0x128/0x300 [ 954.900197][T30284] ? default_file_splice_read+0x920/0x920 [ 954.905881][T30284] __se_sys_splice+0x860/0x1b90 [ 954.910706][T30284] ? security_file_permission+0x128/0x300 [ 954.916393][T30284] ? fput_many+0x42/0x1a0 [ 954.920692][T30284] ? ksys_write+0x237/0x2a0 [ 954.925162][T30284] ? __x64_sys_splice+0xf0/0xf0 [ 954.929980][T30284] ? __x64_sys_splice+0x1d/0xf0 [ 954.934804][T30284] do_syscall_64+0xcb/0x150 [ 954.939284][T30284] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 954.945143][T30284] RIP: 0033:0x45d5b9 [ 954.949008][T30284] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 954.968581][T30284] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 954.976975][T30284] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 954.984917][T30284] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 22:56:09 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/18, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 954.992859][T30284] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 955.000798][T30284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 955.008738][T30284] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:09 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfc, @empty}, 0x1c) [ 955.059045][T30288] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/18, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x300, @empty}, 0x1c) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x500, @empty}, 0x1c) [ 955.196103][T30296] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/19, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 955.320217][T30303] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:10 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x59}, 0x2}], 0x1, 0x2, 0x0) 22:56:10 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18130, 0x0) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x600, @empty}, 0x1c) 22:56:10 executing program 2 (fault-call:12 fault-nth:2): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/19, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:10 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x48}, 0x2}], 0x1, 0x2, 0x0) 22:56:10 executing program 4: mknod$loop(&(0x7f0000000040)='./file0/file0\x00', 0x8, 0x1) unshare(0x44000600) r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$BLKZEROOUT(r0, 0x1268, &(0x7f0000000080)) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x700, @empty}, 0x1c) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x900, @empty}, 0x1c) [ 955.457916][T30315] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. 22:56:10 executing program 4: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x0) ioctl$USBDEVFS_BULK(r0, 0xc0185502, &(0x7f0000000140)={{{0xe, 0x1}}, 0xa3, 0xfffff431, &(0x7f0000000080)="040e5d3e578fa5b2fcf94702279abf9fc15bc93f7e3b765eb0166e12dc46d0bd33139aa08bef85cca2b04b900ba2b34b2ee63799359893de6790361f2907de22d35188213d65298a01c0cd475d737ebf2f27d405990a35410a3c7cd3d0c0cabcc0adcd8ff71ba8ee228b63ca2b011e000533554f9334c981386d8353f7fb4183b72f586e2847aab8585293bf55bc50009c9dc95c004038c5c2766fa9d6dd6061b34eb7"}) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000407d1e5a2d40000000000109022400010000200009040000000000000009210000000122010009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000000380)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="61e6a7ddf5fcbeb9787c2e7b60fe2259310081f30edf4642c3d3599fce7811925c765125a67e30ed29cb2432190ac18594da9c3b"], 0x0}, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) r3 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) [ 955.558830][T30335] FAULT_INJECTION: forcing a failure. [ 955.558830][T30335] name failslab, interval 1, probability 0, space 0, times 0 [ 955.571471][T30335] CPU: 1 PID: 30335 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 955.581600][T30335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 955.591638][T30335] Call Trace: [ 955.594903][T30335] dump_stack+0x1b0/0x21e [ 955.599264][T30335] ? devkmsg_release+0x11c/0x11c [ 955.604191][T30335] ? show_regs_print_info+0x12/0x12 [ 955.609372][T30335] ? stack_trace_save+0x111/0x1e0 [ 955.614364][T30335] should_fail+0x6fb/0x860 [ 955.618752][T30335] ? setup_fault_attr+0x2b0/0x2b0 [ 955.623787][T30335] ? eth_get_headlen+0x240/0x240 [ 955.628701][T30335] ? iov_iter_advance+0x707/0xee0 [ 955.633692][T30335] ? __napi_alloc_skb+0xd6/0x520 [ 955.638601][T30335] should_failslab+0x5/0x20 [ 955.643073][T30335] kmem_cache_alloc+0x36/0x250 [ 955.647810][T30335] __napi_alloc_skb+0xd6/0x520 [ 955.652544][T30335] napi_get_frags+0x5c/0x100 [ 955.657123][T30335] tun_get_user+0x9ce/0x3400 [ 955.661706][T30335] ? tun_do_read+0x1f10/0x1f10 [ 955.666448][T30335] ? unwind_get_return_address_ptr+0x130/0x130 [ 955.672573][T30335] ? memset+0x1f/0x40 [ 955.676539][T30335] ? unwind_next_frame+0x1c07/0x22b0 [ 955.681800][T30335] ? __rcu_read_lock+0x50/0x50 [ 955.686530][T30335] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 955.692585][T30335] tun_chr_write_iter+0x121/0x1a0 [ 955.697590][T30335] __vfs_write+0x579/0x700 [ 955.701984][T30335] ? __kernel_write+0x340/0x340 [ 955.706892][T30335] ? __kernel_text_address+0x93/0x110 [ 955.712231][T30335] ? stack_trace_save+0x111/0x1e0 [ 955.717222][T30335] __kernel_write+0x12c/0x340 [ 955.721892][T30335] write_pipe_buf+0x148/0x1d0 [ 955.726536][T30335] ? splice_from_pipe_next+0x9c/0x440 [ 955.731879][T30335] ? default_file_splice_write+0x240/0x240 [ 955.737652][T30335] ? do_sys_open+0x60f/0x7a0 [ 955.742212][T30335] ? __rcu_read_lock+0x50/0x50 [ 955.746945][T30335] ? anon_pipe_buf_release+0x167/0x1c0 [ 955.752369][T30335] __splice_from_pipe+0x2d3/0x870 [ 955.757370][T30335] ? default_file_splice_write+0x240/0x240 [ 955.763154][T30335] default_file_splice_write+0x179/0x240 [ 955.768853][T30335] ? default_file_splice_read+0x920/0x920 [ 955.774545][T30335] ? avc_policy_seqno+0x17/0x70 [ 955.779367][T30335] ? security_file_permission+0x128/0x300 [ 955.785053][T30335] ? default_file_splice_read+0x920/0x920 [ 955.790757][T30335] __se_sys_splice+0x860/0x1b90 [ 955.795580][T30335] ? security_file_permission+0x128/0x300 [ 955.801283][T30335] ? fput_many+0x42/0x1a0 [ 955.805603][T30335] ? ksys_write+0x237/0x2a0 [ 955.810078][T30335] ? __x64_sys_splice+0xf0/0xf0 [ 955.814896][T30335] ? __x64_sys_splice+0x1d/0xf0 [ 955.819716][T30335] do_syscall_64+0xcb/0x150 [ 955.824206][T30335] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 955.830076][T30335] RIP: 0033:0x45d5b9 [ 955.833939][T30335] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:56:10 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/19, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:10 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xa00, @empty}, 0x1c) [ 955.853541][T30335] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 955.861935][T30335] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 955.869884][T30335] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 955.877832][T30335] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 955.885788][T30335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 955.893758][T30335] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 955.934115][T30341] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.5'. [ 956.064790][ T4047] usb 5-1: new high-speed USB device number 76 using dummy_hcd 22:56:11 executing program 2 (fault-call:12 fault-nth:3): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:11 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x4000, @empty}, 0x1c) 22:56:11 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:11 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x168}, 0x2}], 0x1, 0x2, 0x0) 22:56:11 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18160, 0x0) 22:56:11 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x80fe, @empty}, 0x1c) [ 956.368404][T30352] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:11 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfc00, @empty}, 0x1c) [ 956.424925][ T4047] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 956.438313][ T4047] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.40 [ 956.447910][ T4047] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 956.456373][T30361] FAULT_INJECTION: forcing a failure. [ 956.456373][T30361] name failslab, interval 1, probability 0, space 0, times 0 [ 956.468983][T30361] CPU: 1 PID: 30361 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 956.479109][T30361] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 956.489162][T30361] Call Trace: [ 956.492452][T30361] dump_stack+0x1b0/0x21e [ 956.496750][T30361] ? devkmsg_release+0x11c/0x11c [ 956.501689][T30361] ? show_regs_print_info+0x12/0x12 [ 956.506867][T30361] should_fail+0x6fb/0x860 [ 956.511252][T30361] ? setup_fault_attr+0x2b0/0x2b0 [ 956.516243][T30361] ? eth_get_headlen+0x240/0x240 [ 956.521148][T30361] ? iov_iter_advance+0x707/0xee0 [ 956.526139][T30361] ? __napi_alloc_skb+0xd6/0x520 [ 956.531048][T30361] should_failslab+0x5/0x20 [ 956.535605][T30361] kmem_cache_alloc+0x36/0x250 [ 956.540346][T30361] __napi_alloc_skb+0xd6/0x520 [ 956.545222][T30361] napi_get_frags+0x5c/0x100 [ 956.549789][T30361] tun_get_user+0x9ce/0x3400 [ 956.554350][T30361] ? tun_do_read+0x1f10/0x1f10 [ 956.559082][T30361] ? unwind_get_return_address_ptr+0x130/0x130 [ 956.565215][T30361] ? memset+0x1f/0x40 [ 956.569173][T30361] ? unwind_next_frame+0x1c07/0x22b0 [ 956.574426][T30361] ? __rcu_read_lock+0x50/0x50 [ 956.579160][T30361] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 956.585194][T30361] tun_chr_write_iter+0x121/0x1a0 [ 956.590238][T30361] __vfs_write+0x579/0x700 [ 956.594664][T30361] ? __kernel_write+0x340/0x340 [ 956.599487][T30361] ? __kernel_text_address+0x93/0x110 [ 956.604855][T30361] ? stack_trace_save+0x111/0x1e0 [ 956.609864][T30361] __kernel_write+0x12c/0x340 [ 956.614511][T30361] write_pipe_buf+0x148/0x1d0 [ 956.619179][T30361] ? splice_from_pipe_next+0x9c/0x440 [ 956.624525][T30361] ? default_file_splice_write+0x240/0x240 [ 956.630318][T30361] ? do_sys_open+0x60f/0x7a0 [ 956.634877][T30361] ? __rcu_read_lock+0x50/0x50 [ 956.639609][T30361] ? anon_pipe_buf_release+0x167/0x1c0 [ 956.645034][T30361] __splice_from_pipe+0x2d3/0x870 [ 956.650029][T30361] ? default_file_splice_write+0x240/0x240 [ 956.655812][T30361] default_file_splice_write+0x179/0x240 [ 956.661421][T30361] ? default_file_splice_read+0x920/0x920 [ 956.667133][T30361] ? avc_policy_seqno+0x17/0x70 [ 956.671953][T30361] ? security_file_permission+0x128/0x300 [ 956.677637][T30361] ? default_file_splice_read+0x920/0x920 [ 956.683335][T30361] __se_sys_splice+0x860/0x1b90 [ 956.688158][T30361] ? security_file_permission+0x128/0x300 [ 956.693844][T30361] ? fput_many+0x42/0x1a0 [ 956.698145][T30361] ? ksys_write+0x237/0x2a0 [ 956.702616][T30361] ? __x64_sys_splice+0xf0/0xf0 [ 956.707520][T30361] ? __x64_sys_splice+0x1d/0xf0 [ 956.712368][T30361] do_syscall_64+0xcb/0x150 [ 956.716845][T30361] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 956.722709][T30361] RIP: 0033:0x45d5b9 [ 956.726577][T30361] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 956.746165][T30361] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 956.754561][T30361] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 956.762516][T30361] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 22:56:11 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 956.770496][T30361] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 956.778442][T30361] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 [ 956.786393][T30361] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 956.802634][ T4047] usb 5-1: config 0 descriptor?? 22:56:11 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfe80, @empty}, 0x1c) [ 956.821109][T30367] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:13 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xff00, @empty}, 0x1c) 22:56:13 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x0, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:13 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x195}, 0x2}], 0x1, 0x2, 0x0) 22:56:13 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x181ee, 0x0) 22:56:13 executing program 4: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x56a, 0x3f, 0x40, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000039542f108c07021047e6000000010902240001000000000904db00010a04c80009210300000000810009050a"], 0x0) syz_usb_control_io(r1, &(0x7f0000000440)={0x2c, &(0x7f0000000240)=ANY=[@ANYBLOB="0000810000008100c48b1d081ee94f1d923ef77c353776d968029196262f069b0dcaff3ba21ee0462a319a71cf2ca11628bf6bcd69333e5e054f0e47a343c200000000000000000000000000000002248e1dcdbe5df0f0d7218982a7498ba4f669a66b041a1875c1"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, &(0x7f0000000300)={0x2c, &(0x7f0000000180)={0x20, 0x21, 0xa5, {0xa5, 0xd, "72b600dd37b351ee7fef451f59f388915cfe1391cb518f002c3d99ea849675c467acd1d86f5a86511eaef4912fa3849615a84ff2800174db7ee2f80e71a4506c4cedb270baa35b2e1358b5c98857b58253aa9414a7a487fed3a2b77054bfc3e8fbd936fe715b6f11cf9552282840f63904a30665dad1330cac308c041c38f6c1dfb1b7768e8ad8c889c573073db7637bfd62ad79f506e3494c4f758e4da90ddb8bd437"}}, &(0x7f00000000c0)={0x0, 0x3, 0x75, @string={0x75, 0x3, "0f8d9d63b5b22bc54f1d59cd6aeb35dfcbd4facb50f6a47b0b589591771b1e6015792256a3ff76409126652ebe327e5944095e51967ed1315e6f0c0c365ca052159d1512aac570691af26e417a5489e8ad337789586901d4f2dc574bab8253e4f2b4a366dc1ab397b607852881bf0b4d94a372"}}, &(0x7f0000000240)={0x0, 0xf, 0x27, {0x5, 0xf, 0x27, 0x3, [@ss_container_id={0x14, 0x10, 0x4, 0x81, "f0f82259352900637f5fb9e542507665"}, @wireless={0xb, 0x10, 0x1, 0xc, 0x21, 0x0, 0x1, 0x1, 0x8}, @ptm_cap={0x3}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x6, 0x0, 0x7, 0x7, "4c5d63d0", "b07d9bc7"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x4, 0x80, 0xe1, 0x40, 0xfff7, 0x3a02}}}, &(0x7f0000000780)={0x84, &(0x7f0000000340)={0x10, 0x30, 0x4e, "0dd785fa7431b69b04b6dde99d8b37d929e243596e3fa98e37a2f0ec311b6ad472841c3805ef9c0fe3e2defea283184cae7ace6df49027d5f76fa7d47c66c97a1ba3a4c661f6974c421c7c0a81ff"}, &(0x7f00000003c0)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000400)={0x0, 0x8, 0x1, 0x20}, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000480)={0x20, 0x0, 0x8, {0x4, 0x8, [0x0]}}, &(0x7f00000004c0)={0x40, 0x7, 0x2, 0x800}, &(0x7f0000000500)={0x40, 0x9, 0x1}, &(0x7f0000000540)={0x40, 0xb, 0x2, "8839"}, &(0x7f0000000580)={0x40, 0xf, 0x2, 0x7f}, &(0x7f00000005c0)={0x40, 0x13, 0x6}, &(0x7f0000000600)={0x40, 0x17, 0x6, @local}, &(0x7f0000000640)={0x40, 0x19, 0x2, "a1fd"}, &(0x7f0000000680)={0x40, 0x1a, 0x2}, &(0x7f00000006c0)={0x40, 0x1c, 0x1}, &(0x7f0000000700)={0x40, 0x1e, 0x1, 0x84}, &(0x7f0000000740)={0x40, 0x21, 0x1, 0xff}}) ioctl$RTC_WKALM_RD(0xffffffffffffffff, 0x80287010, &(0x7f0000000000)) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) 22:56:13 executing program 2 (fault-call:12 fault-nth:4): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 958.740379][ T3038] usb 5-1: USB disconnect, device number 76 [ 958.791110][T30388] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:13 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) [ 958.859797][T30395] FAULT_INJECTION: forcing a failure. [ 958.859797][T30395] name failslab, interval 1, probability 0, space 0, times 0 [ 958.873201][T30395] CPU: 0 PID: 30395 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 958.883360][T30395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 958.893413][T30395] Call Trace: [ 958.896699][T30395] dump_stack+0x1b0/0x21e [ 958.901120][T30395] ? devkmsg_release+0x11c/0x11c [ 958.906039][T30395] ? show_regs_print_info+0x12/0x12 [ 958.911344][T30395] ? __rcu_read_lock+0x50/0x50 [ 958.916113][T30395] should_fail+0x6fb/0x860 [ 958.920629][T30395] ? setup_fault_attr+0x2b0/0x2b0 [ 958.925699][T30395] ? setup_fault_attr+0x2b0/0x2b0 [ 958.930704][T30395] ? eth_get_headlen+0x240/0x240 [ 958.935771][T30395] ? tun_get_user+0xc08/0x3400 [ 958.940522][T30395] should_failslab+0x5/0x20 [ 958.945009][T30395] __kmalloc_track_caller+0x5d/0x2b0 [ 958.950283][T30395] ? __napi_alloc_skb+0xd6/0x520 [ 958.955201][T30395] ? tun_get_user+0xc08/0x3400 [ 958.959943][T30395] pskb_expand_head+0x10d/0xfb0 [ 958.964773][T30395] tun_get_user+0xc08/0x3400 [ 958.969346][T30395] ? tun_do_read+0x1f10/0x1f10 [ 958.974093][T30395] ? unwind_get_return_address_ptr+0x130/0x130 [ 958.980257][T30395] ? memset+0x1f/0x40 [ 958.984227][T30395] ? unwind_next_frame+0x1c07/0x22b0 [ 958.989488][T30395] ? __rcu_read_lock+0x50/0x50 [ 958.994279][T30395] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 959.000328][T30395] tun_chr_write_iter+0x121/0x1a0 [ 959.005332][T30395] __vfs_write+0x579/0x700 [ 959.009725][T30395] ? __kernel_write+0x340/0x340 [ 959.014555][T30395] ? __kernel_text_address+0x93/0x110 [ 959.019910][T30395] ? stack_trace_save+0x111/0x1e0 [ 959.024910][T30395] __kernel_write+0x12c/0x340 [ 959.029563][T30395] write_pipe_buf+0x148/0x1d0 [ 959.034217][T30395] ? splice_from_pipe_next+0x9c/0x440 [ 959.039599][T30395] ? default_file_splice_write+0x240/0x240 [ 959.045381][T30395] ? do_sys_open+0x60f/0x7a0 [ 959.049949][T30395] ? __rcu_read_lock+0x50/0x50 [ 959.054690][T30395] ? anon_pipe_buf_release+0x167/0x1c0 [ 959.060122][T30395] __splice_from_pipe+0x2d3/0x870 [ 959.065124][T30395] ? default_file_splice_write+0x240/0x240 [ 959.070951][T30395] default_file_splice_write+0x179/0x240 [ 959.076561][T30395] ? default_file_splice_read+0x920/0x920 [ 959.082255][T30395] ? avc_policy_seqno+0x17/0x70 [ 959.087086][T30395] ? security_file_permission+0x128/0x300 [ 959.092784][T30395] ? default_file_splice_read+0x920/0x920 [ 959.098476][T30395] __se_sys_splice+0x860/0x1b90 [ 959.103302][T30395] ? security_file_permission+0x128/0x300 [ 959.109002][T30395] ? fput_many+0x42/0x1a0 [ 959.113308][T30395] ? ksys_write+0x237/0x2a0 [ 959.117786][T30395] ? __x64_sys_splice+0xf0/0xf0 [ 959.122612][T30395] ? __x64_sys_splice+0x1d/0xf0 [ 959.127437][T30395] do_syscall_64+0xcb/0x150 [ 959.131919][T30395] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 959.137789][T30395] RIP: 0033:0x45d5b9 [ 959.141661][T30395] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 959.161268][T30395] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 959.169657][T30395] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 959.177609][T30395] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 959.185557][T30395] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 959.193515][T30395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 959.201484][T30395] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:14 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x1000000, @empty}, 0x1c) [ 959.218173][T30401] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:14 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:56:14 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2000000, @empty}, 0x1c) [ 959.307981][T30406] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:14 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x3000000, @empty}, 0x1c) 22:56:14 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:56:14 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x4000000, @empty}, 0x1c) [ 959.421513][T30414] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:14 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x5000000, @empty}, 0x1c) [ 959.474632][ T3038] usb 5-1: new high-speed USB device number 77 using dummy_hcd 22:56:14 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x1f4}, 0x2}], 0x1, 0x2, 0x0) 22:56:14 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x181fc, 0x0) [ 959.734631][ T3038] usb 5-1: Using ep0 maxpacket: 32 [ 959.854678][ T3038] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 959.865627][ T3038] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 959.876064][ T3038] usb 5-1: New USB device found, idVendor=056a, idProduct=003f, bcdDevice= 0.40 [ 959.885537][ T3038] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.894280][ T3038] usb 5-1: config 0 descriptor?? [ 960.345024][T30391] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 960.375602][ T3038] wacom 0003:056A:003F.003B: unknown main item tag 0x0 [ 960.382508][ T3038] wacom 0003:056A:003F.003B: unknown main item tag 0x0 [ 960.389498][ T3038] wacom 0003:056A:003F.003B: unknown main item tag 0x0 [ 960.396814][ T3038] wacom 0003:056A:003F.003B: unknown main item tag 0x0 [ 960.403796][ T3038] wacom 0003:056A:003F.003B: unknown main item tag 0x0 [ 960.411893][ T3038] wacom 0003:056A:003F.003B: hidraw0: USB HID v0.00 Device [HID 056a:003f] on usb-dummy_hcd.4-1/input0 [ 960.590468][ T3038] usb 5-1: USB disconnect, device number 77 [ 961.354546][ T3038] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 961.604530][ T3038] usb 5-1: Using ep0 maxpacket: 32 [ 961.724660][ T3038] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 961.735842][ T3038] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 961.745599][ T3038] usb 5-1: New USB device found, idVendor=056a, idProduct=003f, bcdDevice= 0.40 [ 961.754803][ T3038] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 961.763367][ T3038] usb 5-1: config 0 descriptor?? 22:56:16 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x6000000, @empty}, 0x1c) 22:56:16 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) 22:56:16 executing program 2 (fault-call:12 fault-nth:5): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:16 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x240}, 0x2}], 0x1, 0x2, 0x0) 22:56:16 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f0000000500)='./file0\x00', 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x0) mount$overlay(0x400000, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080)='overlay\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="6c6f2a6572646962723d2e2f6275732c776f726b6469723d2e2f666f6c65312c7570706572646966696c65d995453f8888ecf64e22b674c44acbe84e3553f826a3e4910343cd90442c2f768041495fc5c56722d0bd8fe79f70066f2eabad20bd0c48e16a86004bede8de1ddfd78fdbdf8fbc148c7becda1b3bbe29e3f3fb1c8ce813a710ce796182eb2095611d807bfa2870d5503ddc764b85bd51e257f19eb17b7c9548190625eaa6d22e35464ea474041aac29de7275bf4e1c0f8554d6a06b5db4db6fc3811397ef1986d1cee5dba8c953f1c0ff3b97cf43573dda4e988a2e117ae56fa25b685acc523a3b27b31987179a0cdc73fd419767d4d40040bbc9c7d56f98f01faef760ea43942c71789de4819699900c95bafa0cd15758f4ff25cad8625be0141238815d63358b764538e67e90a3411501c0509a30e50b069b33292189d5796af4e98634fdd4d74dc1625d9e58d4197a3056bae632f77d5c2fae403e6f1e24633b482bd11b68b902af905a4f66c028c8c15cdc08a1b6df8b174e323a79702f909526dc28faf0800229deff763775f1c6feb40adcc78f70ba6d207886b75e89eca555e282259a1e0b28fe51f792f8540cac9438b97e69ff37f4bc72fbe205e3aaada6c6"]) chdir(&(0x7f00000002c0)='./bus\x00') fsetxattr$security_ima(0xffffffffffffffff, &(0x7f0000000180)='security.ima\x00', &(0x7f0000000540)=@v2={0x3, 0x3, 0x9, 0x2, 0x95, "5bd0debd54fb113788366ddac80ffddd25d61c79dd27abb93d015eef4d983261225e981169071e51c40dc283ede70b41dbcb561ec85a491faa20723ae49b4e04c8f0bee41d2e90550fe95481fc1bbb681d75b767038f9c99ea0499425853b659685f3a9a3c4be6b0ed96b297fb54196dc45350b533c345f1401836a97c2d1dd39aef0904987310a976d74806619125b5beecaa0350"}, 0x9e, 0x0) r0 = open(&(0x7f0000000200)='./file0/file0\x00', 0x141042, 0x0) pipe2(&(0x7f00000001c0)={0xffffffffffffffff}, 0x44000) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000600)={0x6, 'lo\x00', {}, 0x2}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000640)={0x1, [0x0]}) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000040), 0x8) ioctl$BLKTRACETEARDOWN(r1, 0x1276, 0x0) readahead(r0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'geneve1\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="3f0000006a0b0000070000005000000012a1c56e26bca1d342888c14317de56759e6132966f7a9ecb1d04cf9756e76e1cd807ae55fb7348598800acf950527fd6f6f1259c0520e51227c2bc2008a669a6d9d412f09"]}) 22:56:16 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x2) [ 961.969107][T30449] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 961.984871][ T3038] usbhid 5-1:0.0: can't add hid device: -71 [ 961.990990][ T3038] usbhid: probe of 5-1:0.0 failed with error -71 [ 962.002007][ T3038] usb 5-1: USB disconnect, device number 78 [ 962.012395][T30457] FAULT_INJECTION: forcing a failure. [ 962.012395][T30457] name failslab, interval 1, probability 0, space 0, times 0 [ 962.030467][T30457] CPU: 0 PID: 30457 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 962.040629][T30457] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 962.050677][T30457] Call Trace: [ 962.053969][T30457] dump_stack+0x1b0/0x21e [ 962.058298][T30457] ? devkmsg_release+0x11c/0x11c [ 962.063230][T30457] ? show_regs_print_info+0x12/0x12 22:56:16 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x4) close(r0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x4c142, 0x0) creat(&(0x7f0000000140)='./bus\x00', 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x2002a480}, 0xc805) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000500)='gtp\x00') sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="74235d6eff1e7ba7b29d963b4937bde975137e8e500800af19e250d16e08bfdddbb9916ac6fcd2c8622e0c437ade00b6ab85d06ce0bf2bdcc65e7c71a620fea1224b5b516d947897c3d1788735edc3bf76a83f4d602deadb77cee6dbb2fcb3f4fa9971492fc9a132e19485da186750dcb8b1f43ea47e9ff7f9b732cad9bb8e8a4d23e1579c08d234d93b2b7fb842419e1dc7b938d8c615c88190a39e0ebf62b2df06c3ebd4849117be153638b0931d1fd14db39ef3c68b122cebf9e6c34dcd4eb8feb213826d33c1ecdf6b6d4379a2e318e7f6ccb4a474570cc31e40c51fb76c74a83224778b0723098f8cf896e008e6f58b875b1ce5a3672ab819c1fe10d53e5b201a0f1113e9f6c5ae089c6a29bea5da27fe77497392c66b810000000000000000b98002883c992015e4ab5cf5097f9726000000009bff1b02463072534d2603170913f48d11b3335ffacd2ddf1e64df934a7a4c6012066d8072d1261a4877feb60c72a8164bf2a02154baa6bb4961b959255b4bfd04c14b3ecb1f13ad7b1cd9063bc2229783ab0a3638fd592c0757ad06bfbd2cac9522bf4f5a213b799fcdb11c4ebbdacaf92d73d228b39f9e64092368139d0af3be0ac548444550d4352c49cf99d1e54b4ef9668acd668d473b7808a383d77156465df074330b29c8a5ba469c354ff27dc285653785585baae558162d5ad63af8ff90af8d632bf21d81d3ad80a65187be452efd27a639b3fbc8468c931ac2eec36bf90eab1754e84d3ffab5435ae98141fb8dfef94b845fda13d83ac303dc3d212c2e5fad70e6f4935465f30b5b385fc7469be618140010f0d69fff19dd8f36eab30000000000001493a439a252ac004047ca12fae287fee4dc6753afd3b02759f4a9fcd2000000000000008eee312b0300d055724c79e07c6d4c64fdbc41d314810c7c5b3c73504bbffeabc93996b597ce8ed086729edee8f405f4b33906e2fb7bcdcae76ff7c47792d918127bf62d3d99b94d2bc359e8de6fb38e84f39b0dccd208e407febb07090a63eb8a089e31e650368185645de9a8aea01b78f47309586233dc613be1b4b1d4fe114d8e16b39ccecd99477759e10a6619b04818607d9390", @ANYRES16=r4, @ANYRESDEC], 0x3}, 0x1, 0x0, 0x0, 0x2c942}, 0x8000) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x64, r4, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8}, @GTPA_FLOW={0x6, 0x6, 0x1}, @GTPA_TID={0xc, 0x3, 0x1}, @GTPA_NET_NS_FD={0x8, 0x7, r5}, @GTPA_I_TEI={0x8, 0x8, 0x2}, @GTPA_TID={0xc, 0x3, 0x4}, @GTPA_I_TEI={0x8}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}, @GTPA_I_TEI={0x8, 0x8, 0x4}]}, 0x64}, 0x1, 0x0, 0x0, 0x44}, 0x4040000) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$FS_IOC_SETFLAGS(r6, 0x40086602, &(0x7f0000000080)=0x100000) ftruncate(r1, 0x2008002) r8 = bpf$ITER_CREATE(0x21, &(0x7f0000000280)={r7}, 0x8) ioctl$LOOP_CLR_FD(r8, 0x4c01) sendfile(r0, r1, 0x0, 0x200fff) 22:56:16 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x7000000, @empty}, 0x1c) [ 962.068422][T30457] ? __rcu_read_lock+0x50/0x50 [ 962.073181][T30457] should_fail+0x6fb/0x860 [ 962.077595][T30457] ? setup_fault_attr+0x2b0/0x2b0 [ 962.082608][T30457] ? setup_fault_attr+0x2b0/0x2b0 [ 962.087624][T30457] ? eth_get_headlen+0x240/0x240 [ 962.092557][T30457] ? tun_get_user+0xc08/0x3400 [ 962.097311][T30457] should_failslab+0x5/0x20 [ 962.101809][T30457] __kmalloc_track_caller+0x5d/0x2b0 [ 962.107085][T30457] ? __napi_alloc_skb+0xd6/0x520 [ 962.112010][T30457] ? tun_get_user+0xc08/0x3400 [ 962.116754][T30457] pskb_expand_head+0x10d/0xfb0 [ 962.121576][T30457] tun_get_user+0xc08/0x3400 [ 962.126137][T30457] ? tun_do_read+0x1f10/0x1f10 [ 962.130878][T30457] ? unwind_get_return_address_ptr+0x130/0x130 [ 962.137000][T30457] ? memset+0x1f/0x40 [ 962.140948][T30457] ? unwind_next_frame+0x1c07/0x22b0 [ 962.146201][T30457] ? __rcu_read_lock+0x50/0x50 [ 962.150932][T30457] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 962.156980][T30457] tun_chr_write_iter+0x121/0x1a0 [ 962.161985][T30457] __vfs_write+0x579/0x700 [ 962.166369][T30457] ? __kernel_write+0x340/0x340 [ 962.171188][T30457] ? __kernel_text_address+0x93/0x110 [ 962.176543][T30457] ? stack_trace_save+0x111/0x1e0 [ 962.181573][T30457] __kernel_write+0x12c/0x340 [ 962.186317][T30457] write_pipe_buf+0x148/0x1d0 [ 962.190960][T30457] ? default_file_splice_write+0x240/0x240 [ 962.196731][T30457] ? __rcu_read_lock+0x50/0x50 [ 962.201461][T30457] __splice_from_pipe+0x2d3/0x870 [ 962.206459][T30457] ? default_file_splice_write+0x240/0x240 [ 962.212235][T30457] default_file_splice_write+0x179/0x240 [ 962.217845][T30457] ? default_file_splice_read+0x920/0x920 [ 962.223555][T30457] ? avc_policy_seqno+0x17/0x70 [ 962.228396][T30457] ? security_file_permission+0x128/0x300 [ 962.234100][T30457] ? default_file_splice_read+0x920/0x920 [ 962.239799][T30457] __se_sys_splice+0x860/0x1b90 [ 962.244622][T30457] ? security_file_permission+0x128/0x300 [ 962.250316][T30457] ? fput_many+0x42/0x1a0 [ 962.254613][T30457] ? ksys_write+0x237/0x2a0 [ 962.259096][T30457] ? __x64_sys_splice+0xf0/0xf0 [ 962.263918][T30457] ? __x64_sys_splice+0x1d/0xf0 [ 962.268755][T30457] do_syscall_64+0xcb/0x150 [ 962.273235][T30457] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 962.279099][T30457] RIP: 0033:0x45d5b9 [ 962.282962][T30457] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 962.302540][T30457] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 962.310924][T30457] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 22:56:17 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) [ 962.318869][T30457] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 962.326826][T30457] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 962.334769][T30457] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 962.342711][T30457] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 962.398303][T30470] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:17 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x8000000, @empty}, 0x1c) 22:56:17 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) 22:56:17 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x9000000, @empty}, 0x1c) [ 962.520505][T30479] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:17 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:17 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xa000000, @empty}, 0x1c) [ 962.601158][T30483] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:17 executing program 2 (fault-call:12 fault-nth:6): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:17 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:17 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x241}, 0x2}], 0x1, 0x2, 0x0) 22:56:17 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x3) [ 962.840662][T30496] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 962.896526][T30501] FAULT_INJECTION: forcing a failure. [ 962.896526][T30501] name failslab, interval 1, probability 0, space 0, times 0 [ 962.910260][T30501] CPU: 0 PID: 30501 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 962.920422][T30501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 962.930466][T30501] Call Trace: [ 962.933752][T30501] dump_stack+0x1b0/0x21e [ 962.938073][T30501] ? devkmsg_release+0x11c/0x11c [ 962.942996][T30501] ? show_regs_print_info+0x12/0x12 [ 962.948182][T30501] ? __rcu_read_lock+0x50/0x50 [ 962.952927][T30501] should_fail+0x6fb/0x860 [ 962.957312][T30501] ? setup_fault_attr+0x2b0/0x2b0 [ 962.962302][T30501] ? setup_fault_attr+0x2b0/0x2b0 [ 962.967296][T30501] ? eth_get_headlen+0x240/0x240 [ 962.972201][T30501] ? tun_get_user+0xc08/0x3400 [ 962.976931][T30501] should_failslab+0x5/0x20 [ 962.981401][T30501] __kmalloc_track_caller+0x5d/0x2b0 [ 962.986665][T30501] ? __napi_alloc_skb+0xd6/0x520 [ 962.991579][T30501] ? tun_get_user+0xc08/0x3400 [ 962.996312][T30501] pskb_expand_head+0x10d/0xfb0 [ 963.001190][T30501] tun_get_user+0xc08/0x3400 [ 963.005749][T30501] ? tun_do_read+0x1f10/0x1f10 [ 963.010487][T30501] ? unwind_get_return_address_ptr+0x130/0x130 [ 963.016614][T30501] ? memset+0x1f/0x40 [ 963.020562][T30501] ? unwind_next_frame+0x1c07/0x22b0 [ 963.025874][T30501] ? __rcu_read_lock+0x50/0x50 [ 963.030624][T30501] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 963.036665][T30501] tun_chr_write_iter+0x121/0x1a0 [ 963.041660][T30501] __vfs_write+0x579/0x700 [ 963.046095][T30501] ? __kernel_write+0x340/0x340 [ 963.050914][T30501] ? __kernel_text_address+0x93/0x110 [ 963.056254][T30501] ? stack_trace_save+0x111/0x1e0 [ 963.061292][T30501] __kernel_write+0x12c/0x340 [ 963.065953][T30501] write_pipe_buf+0x148/0x1d0 [ 963.070604][T30501] ? default_file_splice_write+0x240/0x240 [ 963.076378][T30501] ? __rcu_read_lock+0x50/0x50 [ 963.081113][T30501] __splice_from_pipe+0x2d3/0x870 [ 963.086153][T30501] ? default_file_splice_write+0x240/0x240 [ 963.091928][T30501] default_file_splice_write+0x179/0x240 [ 963.097536][T30501] ? default_file_splice_read+0x920/0x920 [ 963.103227][T30501] ? avc_policy_seqno+0x17/0x70 [ 963.108049][T30501] ? security_file_permission+0x128/0x300 [ 963.113742][T30501] ? default_file_splice_read+0x920/0x920 [ 963.119434][T30501] __se_sys_splice+0x860/0x1b90 [ 963.124265][T30501] ? security_file_permission+0x128/0x300 [ 963.129973][T30501] ? fput_many+0x42/0x1a0 [ 963.134291][T30501] ? ksys_write+0x237/0x2a0 [ 963.138768][T30501] ? __x64_sys_splice+0xf0/0xf0 [ 963.143586][T30501] ? __x64_sys_splice+0x1d/0xf0 [ 963.148404][T30501] do_syscall_64+0xcb/0x150 [ 963.152874][T30501] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 963.158731][T30501] RIP: 0033:0x45d5b9 [ 963.162592][T30501] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 963.182165][T30501] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:56:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0fad7}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r1 = getpid() pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x5) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfffffe00}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x60, 0x0, 0x0, 0x203}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040)='NLBL_MGMT\x00') 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x40000000, @empty}, 0x1c) 22:56:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 963.190545][T30501] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 963.198490][T30501] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 963.206438][T30501] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 963.214391][T30501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006 [ 963.222342][T30501] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xe0ffffff, @empty}, 0x1c) [ 963.279572][T30511] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xf5ffffff, @empty}, 0x1c) [ 963.373999][T30523] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfc000000, @empty}, 0x1c) [ 963.462278][T30528] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:18 executing program 2 (fault-call:12 fault-nth:7): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:18 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r8], 0x20}}, 0x0) 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfe800000, @empty}, 0x1c) 22:56:18 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0fad7}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r1 = getpid() pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000140)=0x5) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0xfffffe00}], 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x60, 0x0, 0x0, 0x203}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040)='NLBL_MGMT\x00') 22:56:18 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x300}, 0x2}], 0x1, 0x2, 0x0) 22:56:18 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x5) 22:56:18 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfe80ffff, @empty}, 0x1c) [ 963.800694][T30545] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 963.845422][T30555] FAULT_INJECTION: forcing a failure. [ 963.845422][T30555] name failslab, interval 1, probability 0, space 0, times 0 [ 963.858363][T30555] CPU: 1 PID: 30555 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 963.868506][T30555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 963.878550][T30555] Call Trace: [ 963.881832][T30555] dump_stack+0x1b0/0x21e [ 963.886150][T30555] ? devkmsg_release+0x11c/0x11c [ 963.891080][T30555] ? show_regs_print_info+0x12/0x12 [ 963.896272][T30555] ? __rcu_read_lock+0x50/0x50 [ 963.901031][T30555] ? _raw_spin_lock+0xa1/0x170 [ 963.905783][T30555] ? _raw_spin_trylock_bh+0x190/0x190 [ 963.911156][T30555] should_fail+0x6fb/0x860 [ 963.915562][T30555] ? setup_fault_attr+0x2b0/0x2b0 [ 963.920579][T30555] ? setup_fault_attr+0x2b0/0x2b0 [ 963.925594][T30555] ? eth_get_headlen+0x240/0x240 [ 963.930519][T30555] ? tun_get_user+0xc08/0x3400 [ 963.935268][T30555] should_failslab+0x5/0x20 [ 963.939765][T30555] __kmalloc_track_caller+0x5d/0x2b0 [ 963.945042][T30555] ? __napi_alloc_skb+0xd6/0x520 [ 963.949969][T30555] ? tun_get_user+0xc08/0x3400 [ 963.954720][T30555] pskb_expand_head+0x10d/0xfb0 [ 963.959561][T30555] tun_get_user+0xc08/0x3400 [ 963.964145][T30555] ? tun_do_read+0x1f10/0x1f10 [ 963.968911][T30555] ? unwind_get_return_address_ptr+0x130/0x130 [ 963.975050][T30555] ? memset+0x1f/0x40 [ 963.977773][T30557] syz-executor.4 (30557) used greatest stack depth: 20208 bytes left [ 963.979016][T30555] ? unwind_next_frame+0x1c07/0x22b0 [ 963.979030][T30555] ? __rcu_read_lock+0x50/0x50 [ 963.997072][T30555] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 964.003120][T30555] tun_chr_write_iter+0x121/0x1a0 [ 964.008116][T30555] __vfs_write+0x579/0x700 [ 964.012500][T30555] ? __kernel_write+0x340/0x340 [ 964.017317][T30555] ? __kernel_text_address+0x93/0x110 [ 964.022658][T30555] ? stack_trace_save+0x111/0x1e0 [ 964.027707][T30555] __kernel_write+0x12c/0x340 [ 964.032351][T30555] write_pipe_buf+0x148/0x1d0 [ 964.036995][T30555] ? default_file_splice_write+0x240/0x240 [ 964.042815][T30555] ? __rcu_read_lock+0x50/0x50 [ 964.047544][T30555] __splice_from_pipe+0x2d3/0x870 [ 964.052537][T30555] ? default_file_splice_write+0x240/0x240 [ 964.058308][T30555] default_file_splice_write+0x179/0x240 [ 964.063918][T30555] ? default_file_splice_read+0x920/0x920 [ 964.069606][T30555] ? avc_policy_seqno+0x17/0x70 [ 964.074448][T30555] ? security_file_permission+0x128/0x300 [ 964.080136][T30555] ? default_file_splice_read+0x920/0x920 [ 964.085819][T30555] __se_sys_splice+0x860/0x1b90 [ 964.090673][T30555] ? security_file_permission+0x128/0x300 [ 964.096359][T30555] ? fput_many+0x42/0x1a0 [ 964.100660][T30555] ? ksys_write+0x237/0x2a0 [ 964.105151][T30555] ? __x64_sys_splice+0xf0/0xf0 [ 964.109967][T30555] ? __x64_sys_splice+0x1d/0xf0 [ 964.114789][T30555] do_syscall_64+0xcb/0x150 [ 964.119264][T30555] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 964.125171][T30555] RIP: 0033:0x45d5b9 22:56:19 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000041c0)=[{{&(0x7f0000000780)=@xdp, 0x80, &(0x7f0000000b40)=[{0x0}], 0x1, &(0x7f0000000bc0)=""/98, 0x62}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_FPEXC(0xb, 0x0) fcntl$setpipe(r3, 0x407, 0x0) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080aa56e7f1dc290f45a2dc37000bcdbdf250006001201030000000600ab0001040000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x35) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f0000000340)) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x1, 0x0, 0x7}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x363) r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffd, 0x0, @perf_bp={0x0}, 0x4a2, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r4, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0090e0f38c28a447"]) 22:56:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, 0x0, 0x0) [ 964.129033][T30555] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 964.148639][T30555] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 964.157016][T30555] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 964.164957][T30555] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 964.172897][T30555] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 964.180837][T30555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000007 [ 964.188793][T30555] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:19 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfec0ffff, @empty}, 0x1c) [ 964.220686][T30564] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, 0x0, 0x0) 22:56:19 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xff000000, @empty}, 0x1c) [ 964.381526][T30574] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:19 executing program 2 (fault-call:12 fault-nth:8): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:19 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000041c0)=[{{&(0x7f0000000780)=@xdp, 0x80, &(0x7f0000000b40)=[{0x0}], 0x1, &(0x7f0000000bc0)=""/98, 0x62}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_FPEXC(0xb, 0x0) fcntl$setpipe(r3, 0x407, 0x0) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080aa56e7f1dc290f45a2dc37000bcdbdf250006001201030000000600ab0001040000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x35) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f0000000340)) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x1, 0x0, 0x7}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x363) r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffd, 0x0, @perf_bp={0x0}, 0x4a2, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r4, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0090e0f38c28a447"]) 22:56:19 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xffff0000, @empty}, 0x1c) 22:56:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, 0x0, 0x0) 22:56:19 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x3e8}, 0x2}], 0x1, 0x2, 0x0) 22:56:19 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x8) [ 964.642281][T30588] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 964.696430][T30596] FAULT_INJECTION: forcing a failure. [ 964.696430][T30596] name failslab, interval 1, probability 0, space 0, times 0 [ 964.709071][T30596] CPU: 1 PID: 30596 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 964.719217][T30596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 964.729250][T30596] Call Trace: [ 964.732577][T30596] dump_stack+0x1b0/0x21e [ 964.736885][T30596] ? devkmsg_release+0x11c/0x11c [ 964.741799][T30596] ? show_regs_print_info+0x12/0x12 [ 964.746977][T30596] ? get_random_u32+0x112/0x210 [ 964.751834][T30596] ? kasan_init_slab_obj+0x20/0x30 [ 964.756915][T30596] ? new_slab+0x21c/0x450 [ 964.761215][T30596] should_fail+0x6fb/0x860 [ 964.765600][T30596] ? setup_fault_attr+0x2b0/0x2b0 [ 964.770600][T30596] ? eth_get_headlen+0x240/0x240 [ 964.775517][T30596] ? iov_iter_advance+0x707/0xee0 [ 964.780518][T30596] ? __napi_alloc_skb+0xd6/0x520 [ 964.785442][T30596] should_failslab+0x5/0x20 [ 964.789921][T30596] kmem_cache_alloc+0x36/0x250 [ 964.794658][T30596] __napi_alloc_skb+0xd6/0x520 [ 964.799393][T30596] napi_get_frags+0x5c/0x100 [ 964.804009][T30596] tun_get_user+0x9ce/0x3400 [ 964.808583][T30596] ? tun_do_read+0x1f10/0x1f10 [ 964.813318][T30596] ? unwind_get_return_address_ptr+0x130/0x130 [ 964.819446][T30596] ? memset+0x1f/0x40 [ 964.823409][T30596] ? unwind_next_frame+0x1c07/0x22b0 [ 964.828662][T30596] ? __rcu_read_lock+0x50/0x50 [ 964.833395][T30596] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 964.839474][T30596] tun_chr_write_iter+0x121/0x1a0 [ 964.844555][T30596] __vfs_write+0x579/0x700 [ 964.848941][T30596] ? __kernel_write+0x340/0x340 [ 964.853761][T30596] ? __kernel_text_address+0x93/0x110 [ 964.859108][T30596] ? stack_trace_save+0x111/0x1e0 [ 964.864133][T30596] __kernel_write+0x12c/0x340 [ 964.868778][T30596] write_pipe_buf+0x148/0x1d0 [ 964.873461][T30596] ? default_file_splice_write+0x240/0x240 [ 964.879248][T30596] ? __rcu_read_lock+0x50/0x50 [ 964.883988][T30596] __splice_from_pipe+0x2d3/0x870 [ 964.888993][T30596] ? default_file_splice_write+0x240/0x240 [ 964.894773][T30596] default_file_splice_write+0x179/0x240 [ 964.900383][T30596] ? default_file_splice_read+0x920/0x920 [ 964.906068][T30596] ? avc_policy_seqno+0x17/0x70 [ 964.910897][T30596] ? security_file_permission+0x128/0x300 [ 964.916585][T30596] ? default_file_splice_read+0x920/0x920 [ 964.922271][T30596] __se_sys_splice+0x860/0x1b90 [ 964.927098][T30596] ? security_file_permission+0x128/0x300 [ 964.932789][T30596] ? fput_many+0x42/0x1a0 [ 964.937085][T30596] ? ksys_write+0x237/0x2a0 [ 964.941557][T30596] ? __x64_sys_splice+0xf0/0xf0 [ 964.946374][T30596] ? __x64_sys_splice+0x1d/0xf0 [ 964.951192][T30596] do_syscall_64+0xcb/0x150 [ 964.955675][T30596] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 964.961536][T30596] RIP: 0033:0x45d5b9 [ 964.965403][T30596] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 964.984980][T30596] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 964.993377][T30596] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 965.001318][T30596] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 965.009284][T30596] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 965.017228][T30596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008 [ 965.025177][T30596] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:19 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xffff80fe, @empty}, 0x1c) 22:56:19 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 22:56:20 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000041c0)=[{{&(0x7f0000000780)=@xdp, 0x80, &(0x7f0000000b40)=[{0x0}], 0x1, &(0x7f0000000bc0)=""/98, 0x62}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_GET_FPEXC(0xb, 0x0) fcntl$setpipe(r3, 0x407, 0x0) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="080aa56e7f1dc290f45a2dc37000bcdbdf250006001201030000000600ab0001040000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RGETLOCK(r2, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x35) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f0000000340)) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x1, 0x0, 0x7}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x363) r4 = perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ffffd, 0x0, @perf_bp={0x0}, 0x4a2, 0x0, 0x0, 0x0, 0x5, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r4, 0x0) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c0090e0f38c28a447"]) [ 965.187204][T30606] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xffffc0fe, @empty}, 0x1c) 22:56:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xffffffe0, @empty}, 0x1c) [ 965.371459][T30616] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:20 executing program 2 (fault-call:12 fault-nth:9): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:20 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x0, 0x0) unshare(0x44000400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = timerfd_create(0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8983, 0x0) 22:56:20 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x480}, 0x2}], 0x1, 0x2, 0x0) 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0xfffffff5, @empty}, 0x1c) 22:56:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 22:56:20 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xd) 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x2]}}, 0x1c) 22:56:20 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x0, 0x0) unshare(0x44000400) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = timerfd_create(0x1, 0x0) r2 = fcntl$dupfd(r0, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8983, 0x0) [ 965.533679][T30634] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:20 executing program 4: r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000340)=ANY=[@ANYRES16=0x0, @ANYRESHEX, @ANYBLOB="fdba136801a15c3838093fbef229c95fda35c65d79234dca70e459baf9135b08941a782e0d7e89242ced5629e1a5e55cb2b3c7ddad8be87295a69940dc4e4738e6b7986b0518400fe0220cbe1e8f5e6c89bf47856f2681c9b2b9e129cb307b241fbfbbe9d43863cbdc159665f8e7a8dfc0155b18a08b98a2dde49c6ad71455ad2288c47af35053f101b0a492e2bc607424d17b6f166b2357"], 0x0) syz_usb_connect(0x2, 0xfebe, &(0x7f00000000c0)={{0x12, 0x1, 0x250, 0x86, 0xe0, 0xfa, 0xff, 0x5d1, 0x5001, 0xb499, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6b, 0x1, 0x1f, 0x0, 0x20, 0x7f, [{{0x9, 0x4, 0x19, 0xe6, 0x1, 0xa8, 0xfc, 0xd3, 0x3f, [@cdc_ncm={{0xb, 0x24, 0x6, 0x0, 0x1, "402404deff4e"}, {0x5, 0x24, 0x0, 0x7f}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x1, 0x100, 0x20}, {0x6, 0x24, 0x1a, 0xb76e, 0x4}, [@country_functional={0x10, 0x24, 0x7, 0xb9, 0xeb, [0x6, 0x7, 0x45d0, 0x101, 0x20]}, @network_terminal={0x7, 0x24, 0xa, 0x3, 0x42, 0x4e, 0x9}, @country_functional={0x8, 0x24, 0x7, 0x40, 0x1, [0x3f]}, @dmm={0x7, 0x24, 0x14, 0x8b0, 0x8}]}], [{{0x9, 0x5, 0x6, 0xc, 0x20, 0xb3, 0x1f, 0x44, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0x8}]}}]}}]}}]}}, &(0x7f0000000280)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x110, 0x3f, 0x3f, 0x3f, 0x10, 0x67}, 0x8, &(0x7f0000000400)=ANY=[@ANYBLOB="084dd1f40f0800010304007b4c07e11f0243d0c96a056a634401e38f4afbe1dce23394caeb84b2b527f90417de70317c09e773159a03f8fc8441cebc607e881fcbe5f106669e0b2ca1bcb9715c13b2181edac374b63870292372141d7a3df28c2c60af12f230a45998bc7e612cdaa0b9d30601c089f5443ff7cfd2d879e801a4b72a06462640b1da4607f248ca46938013cec7f37df179ea792e5d9821abd557ea2687e3b27325fa044f8cdcd4019c162d957698c825cebe3ae1f02a33693cf7b663c1834fc80a31fd9fd55542b16bfa6931d3594be9ae07e50f4766a452f34390fa28977742fb1144d57a2233debba3f2b751ffc0c9da46f86d182b249c"], 0x2, [{0xffc3, &(0x7f00000001c0)=@lang_id={0x0, 0x3, 0x447}}, {0x4, &(0x7f0000000240)=@lang_id={0x4, 0x3, 0x42a}}]}) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000140)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x80, 0x1c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000580)={0x14, 0x0, &(0x7f0000000540)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) [ 965.585130][T30654] FAULT_INJECTION: forcing a failure. [ 965.585130][T30654] name failslab, interval 1, probability 0, space 0, times 0 [ 965.598607][T30654] CPU: 1 PID: 30654 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 965.608755][T30654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 965.618858][T30654] Call Trace: [ 965.622120][T30654] dump_stack+0x1b0/0x21e [ 965.626420][T30654] ? devkmsg_release+0x11c/0x11c [ 965.631325][T30654] ? show_regs_print_info+0x12/0x12 [ 965.636487][T30654] ? __rcu_read_lock+0x50/0x50 [ 965.641217][T30654] ? _raw_spin_lock+0xa1/0x170 [ 965.645946][T30654] ? _raw_spin_trylock_bh+0x190/0x190 [ 965.651286][T30654] should_fail+0x6fb/0x860 [ 965.655723][T30654] ? setup_fault_attr+0x2b0/0x2b0 [ 965.660718][T30654] ? setup_fault_attr+0x2b0/0x2b0 [ 965.665711][T30654] ? eth_get_headlen+0x240/0x240 [ 965.670620][T30654] ? tun_get_user+0xc08/0x3400 [ 965.675389][T30654] should_failslab+0x5/0x20 [ 965.679861][T30654] __kmalloc_track_caller+0x5d/0x2b0 [ 965.685113][T30654] ? __napi_alloc_skb+0xd6/0x520 [ 965.690017][T30654] ? tun_get_user+0xc08/0x3400 [ 965.694752][T30654] pskb_expand_head+0x10d/0xfb0 [ 965.699575][T30654] tun_get_user+0xc08/0x3400 [ 965.704196][T30654] ? tun_do_read+0x1f10/0x1f10 [ 965.708928][T30654] ? unwind_get_return_address_ptr+0x130/0x130 [ 965.715102][T30654] ? memset+0x1f/0x40 [ 965.719052][T30654] ? unwind_next_frame+0x1c07/0x22b0 [ 965.724313][T30654] ? __rcu_read_lock+0x50/0x50 [ 965.729050][T30654] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 965.735088][T30654] tun_chr_write_iter+0x121/0x1a0 [ 965.740088][T30654] __vfs_write+0x579/0x700 [ 965.744474][T30654] ? __kernel_write+0x340/0x340 [ 965.749311][T30654] ? __kernel_text_address+0x93/0x110 [ 965.754669][T30654] ? stack_trace_save+0x111/0x1e0 [ 965.759661][T30654] __kernel_write+0x12c/0x340 [ 965.764326][T30654] write_pipe_buf+0x148/0x1d0 [ 965.768980][T30654] ? default_file_splice_write+0x240/0x240 [ 965.774756][T30654] ? __rcu_read_lock+0x50/0x50 [ 965.779488][T30654] __splice_from_pipe+0x2d3/0x870 [ 965.784492][T30654] ? default_file_splice_write+0x240/0x240 [ 965.790277][T30654] default_file_splice_write+0x179/0x240 [ 965.795890][T30654] ? default_file_splice_read+0x920/0x920 [ 965.801594][T30654] ? avc_policy_seqno+0x17/0x70 [ 965.806431][T30654] ? security_file_permission+0x128/0x300 [ 965.812117][T30654] ? default_file_splice_read+0x920/0x920 [ 965.817822][T30654] __se_sys_splice+0x860/0x1b90 [ 965.822656][T30654] ? security_file_permission+0x128/0x300 [ 965.828347][T30654] ? fput_many+0x42/0x1a0 [ 965.832669][T30654] ? ksys_write+0x237/0x2a0 [ 965.837148][T30654] ? __x64_sys_splice+0xf0/0xf0 [ 965.841983][T30654] ? __x64_sys_splice+0x1d/0xf0 [ 965.846801][T30654] do_syscall_64+0xcb/0x150 [ 965.851271][T30654] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 965.857128][T30654] RIP: 0033:0x45d5b9 [ 965.860991][T30654] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:56:20 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}}, 0x0) [ 965.874286][ T3038] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 965.880582][T30654] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 965.880591][T30654] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 965.880595][T30654] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 965.880606][T30654] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 965.920336][T30654] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 [ 965.928276][T30654] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:20 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x3]}}, 0x1c) [ 965.950262][T30663] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 966.154266][ T3038] usb 5-1: device descriptor read/64, error 18 22:56:21 executing program 2 (fault-call:12 fault-nth:10): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}}, 0x0) 22:56:21 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x4]}}, 0x1c) 22:56:21 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xa00}, 0x2}], 0x1, 0x2, 0x0) 22:56:21 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xf) 22:56:21 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x5]}}, 0x1c) [ 966.364353][T30675] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 966.422487][T30684] FAULT_INJECTION: forcing a failure. [ 966.422487][T30684] name failslab, interval 1, probability 0, space 0, times 0 [ 966.435295][T30684] CPU: 0 PID: 30684 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 966.445424][T30684] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 966.455461][T30684] Call Trace: [ 966.458733][T30684] dump_stack+0x1b0/0x21e [ 966.463037][T30684] ? devkmsg_release+0x11c/0x11c [ 966.467952][T30684] ? show_regs_print_info+0x12/0x12 [ 966.473124][T30684] ? _raw_spin_lock+0xa1/0x170 [ 966.478014][T30684] ? _raw_spin_trylock_bh+0x190/0x190 [ 966.483356][T30684] should_fail+0x6fb/0x860 [ 966.487742][T30684] ? setup_fault_attr+0x2b0/0x2b0 [ 966.492735][T30684] ? eth_get_headlen+0x240/0x240 [ 966.497678][T30684] ? iov_iter_advance+0x707/0xee0 [ 966.502693][T30684] ? __napi_alloc_skb+0xd6/0x520 [ 966.507608][T30684] should_failslab+0x5/0x20 [ 966.512082][T30684] kmem_cache_alloc+0x36/0x250 [ 966.516814][T30684] __napi_alloc_skb+0xd6/0x520 [ 966.521593][T30684] napi_get_frags+0x5c/0x100 [ 966.526153][T30684] tun_get_user+0x9ce/0x3400 [ 966.530716][T30684] ? schedule_preempt_disabled+0x20/0x20 [ 966.536316][T30684] ? tun_do_read+0x1f10/0x1f10 [ 966.541048][T30684] ? ___preempt_schedule+0x16/0x20 [ 966.546132][T30684] ? memset+0x1f/0x40 [ 966.551088][T30684] ? unwind_next_frame+0x1c07/0x22b0 [ 966.556356][T30684] ? __rcu_read_lock+0x50/0x50 [ 966.561096][T30684] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 966.567144][T30684] tun_chr_write_iter+0x121/0x1a0 [ 966.572141][T30684] __vfs_write+0x579/0x700 [ 966.576529][T30684] ? __kernel_write+0x340/0x340 [ 966.581351][T30684] ? __perf_event_task_sched_in+0x4ed/0x550 [ 966.587216][T30684] ? trace_event_raw_event_tlb_flush+0x220/0x220 [ 966.593513][T30684] __kernel_write+0x12c/0x340 [ 966.598159][T30684] write_pipe_buf+0x148/0x1d0 [ 966.602901][T30684] ? default_file_splice_write+0x240/0x240 [ 966.608675][T30684] __splice_from_pipe+0x2d3/0x870 [ 966.613666][T30684] ? default_file_splice_write+0x240/0x240 [ 966.619437][T30684] default_file_splice_write+0x179/0x240 [ 966.625035][T30684] ? default_file_splice_read+0x920/0x920 [ 966.630736][T30684] ? avc_policy_seqno+0x17/0x70 [ 966.635565][T30684] ? security_file_permission+0x128/0x300 [ 966.641271][T30684] ? default_file_splice_read+0x920/0x920 [ 966.646957][T30684] __se_sys_splice+0x860/0x1b90 [ 966.651789][T30684] ? security_file_permission+0x128/0x300 [ 966.657507][T30684] ? fput_many+0x42/0x1a0 [ 966.661811][T30684] ? ksys_write+0x237/0x2a0 [ 966.666282][T30684] ? __x64_sys_splice+0xf0/0xf0 [ 966.671098][T30684] ? __x64_sys_splice+0x1d/0xf0 [ 966.675917][T30684] do_syscall_64+0xcb/0x150 [ 966.680390][T30684] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 966.686264][T30684] RIP: 0033:0x45d5b9 [ 966.690125][T30684] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 966.709697][T30684] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:56:21 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x20}}, 0x0) [ 966.718094][T30684] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 966.726039][T30684] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 966.733984][T30684] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 966.741924][T30684] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000a [ 966.749869][T30684] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:21 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x6]}}, 0x1c) [ 966.807640][T30688] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 966.824497][ T3038] usb 5-1: device descriptor read/64, error 18 22:56:21 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x7]}}, 0x1c) [ 967.094224][ T3038] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 967.364216][ T3038] usb 5-1: device descriptor read/64, error 18 [ 967.754228][ T3038] usb 5-1: device descriptor read/64, error 18 [ 967.874427][ T3038] usb usb5-port1: attempt power cycle 22:56:23 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x8]}}, 0x1c) 22:56:23 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x159a) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r6, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(r3, &(0x7f0000000240)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x8, 0x3c, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}, @mcast2, {[@hopopts]}}}}}}, 0x42) write$binfmt_misc(r3, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r2, 0x0, r4, 0x0, 0x18100, 0x0) 22:56:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20], 0x20}}, 0x0) 22:56:23 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xf00}, 0x2}], 0x1, 0x2, 0x0) 22:56:23 executing program 2 (fault-call:12 fault-nth:11): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:23 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x28) [ 968.584178][ T3038] usb 5-1: new high-speed USB device number 81 using dummy_hcd 22:56:23 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x9]}}, 0x1c) [ 968.650527][T30706] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 968.714356][ T3038] usb 5-1: device descriptor read/8, error -71 [ 968.720241][T30717] FAULT_INJECTION: forcing a failure. [ 968.720241][T30717] name failslab, interval 1, probability 0, space 0, times 0 [ 968.733142][T30717] CPU: 1 PID: 30717 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 968.743264][T30717] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 968.753343][T30717] Call Trace: [ 968.756617][T30717] dump_stack+0x1b0/0x21e [ 968.760924][T30717] ? devkmsg_release+0x11c/0x11c [ 968.765836][T30717] ? show_regs_print_info+0x12/0x12 [ 968.771002][T30717] ? __rcu_read_lock+0x50/0x50 [ 968.775874][T30717] ? get_random_u32+0x112/0x210 [ 968.780700][T30717] ? kasan_init_slab_obj+0x20/0x30 [ 968.785794][T30717] should_fail+0x6fb/0x860 [ 968.790194][T30717] ? setup_fault_attr+0x2b0/0x2b0 [ 968.795199][T30717] ? setup_fault_attr+0x2b0/0x2b0 [ 968.800194][T30717] ? eth_get_headlen+0x240/0x240 [ 968.805101][T30717] ? tun_get_user+0xc08/0x3400 [ 968.809831][T30717] should_failslab+0x5/0x20 [ 968.814304][T30717] __kmalloc_track_caller+0x5d/0x2b0 [ 968.819596][T30717] ? __napi_alloc_skb+0xd6/0x520 [ 968.824501][T30717] ? tun_get_user+0xc08/0x3400 [ 968.829268][T30717] pskb_expand_head+0x10d/0xfb0 [ 968.834093][T30717] tun_get_user+0xc08/0x3400 [ 968.838709][T30717] ? tun_do_read+0x1f10/0x1f10 [ 968.843450][T30717] ? unwind_get_return_address_ptr+0x130/0x130 [ 968.849616][T30717] ? memset+0x1f/0x40 [ 968.853566][T30717] ? unwind_next_frame+0x1c07/0x22b0 [ 968.858825][T30717] ? __rcu_read_lock+0x50/0x50 [ 968.863580][T30717] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 968.869620][T30717] tun_chr_write_iter+0x121/0x1a0 [ 968.874614][T30717] __vfs_write+0x579/0x700 [ 968.879007][T30717] ? __kernel_write+0x340/0x340 [ 968.883835][T30717] ? __kernel_text_address+0x93/0x110 [ 968.889185][T30717] ? stack_trace_save+0x111/0x1e0 [ 968.894183][T30717] __kernel_write+0x12c/0x340 [ 968.898851][T30717] write_pipe_buf+0x148/0x1d0 [ 968.903516][T30717] ? default_file_splice_write+0x240/0x240 [ 968.909292][T30717] ? __rcu_read_lock+0x50/0x50 [ 968.914023][T30717] __splice_from_pipe+0x2d3/0x870 [ 968.919027][T30717] ? default_file_splice_write+0x240/0x240 [ 968.924801][T30717] default_file_splice_write+0x179/0x240 [ 968.930417][T30717] ? default_file_splice_read+0x920/0x920 [ 968.936102][T30717] ? avc_policy_seqno+0x17/0x70 [ 968.940938][T30717] ? security_file_permission+0x128/0x300 [ 968.946621][T30717] ? default_file_splice_read+0x920/0x920 [ 968.952328][T30717] __se_sys_splice+0x860/0x1b90 [ 968.957161][T30717] ? security_file_permission+0x128/0x300 [ 968.962847][T30717] ? fput_many+0x42/0x1a0 [ 968.967143][T30717] ? ksys_write+0x237/0x2a0 [ 968.971624][T30717] ? __x64_sys_splice+0xf0/0xf0 [ 968.976447][T30717] ? __x64_sys_splice+0x1d/0xf0 [ 968.981273][T30717] do_syscall_64+0xcb/0x150 [ 968.985750][T30717] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 968.991626][T30717] RIP: 0033:0x45d5b9 [ 968.995491][T30717] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 22:56:23 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20], 0x20}}, 0x0) [ 969.015073][T30717] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 969.023464][T30717] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 969.031402][T30717] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 969.039357][T30717] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 969.047307][T30717] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000b [ 969.055254][T30717] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:23 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0xa]}}, 0x1c) [ 969.088106][T30722] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20], 0x20}}, 0x0) 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0xfc]}}, 0x1c) [ 969.164160][ T3038] usb 5-1: device descriptor read/8, error -71 [ 969.202029][T30729] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x2]}}, 0x1c) [ 969.333818][T30736] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x3]}}, 0x1c) 22:56:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) 22:56:24 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x1500}, 0x2}], 0x1, 0x2, 0x0) 22:56:24 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x30) 22:56:24 executing program 2 (fault-call:12 fault-nth:12): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:24 executing program 4: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000580)="81d96b7402dcea4264158d34b74729dd94aa81c317d83929da1894711bcf5c334566f2cb020210264a597558d783f9dc177e564aef15ed488f9328914bb7e2b7c7d2c8308976550dc3c4437b55fb93d4424e79204dedd5f64c2539063f532486232563ac7e584ca8219fbed209c66ce50009449d2eb404839fa5036554946df173ee10ae33fc32863fd056ab9f30e328b2776426a38fabdb8609376e7cca7a14dd293b06afcc21b29f248e19c81b2d198a33954b3a3b85937e6d1c5be8edb7d8955b9cfd1870dce30e45fd80ed7063f99ff339cea168a4d509fac5e7a2ff178d15f605181c33f2e6b3addb5fc5d83ef54d485a54bb9faf42d5f016824659e48fc358908dd31ce4dbe9debe15ae3b0634362860f2edfc7dd24e666d5cd65943e4ec12c1ce48c870cbc67ddcd94aa07d6dabe501588489d33f2849567b84f9c70b4197", 0x142}], 0x1, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r6, 0x407, 0x0) write$P9_RFSYNC(r6, &(0x7f0000000700)={0x7, 0x33, 0x2}, 0x7) write$cgroup_subtree(r4, &(0x7f0000000780)={[{0x2b, 'cpu'}, {0x2d, 'memory'}, {0x2b, 'cpu'}, {0x2d, 'io'}]}, 0x16) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000740)) fcntl$setpipe(r5, 0x407, 0x0) ioctl$CHAR_RAW_ROGET(r5, 0x125e, &(0x7f0000000540)) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x4d8, 0x0, 0x0, 0x148, 0x0, 0x148, 0x440, 0x240, 0x240, 0x440, 0x240, 0x3, 0x0, {[{{@ip={@local, @empty, 0x0, 0x0, 'ip6gretap0\x00', 'team_slave_0\x00'}, 0x0, 0x2f8, 0x360, 0x0, {}, [@common=@inet=@hashlimit1={{0x58, 'hashlimit\x00'}, {'lo\x00', {0x35, 0x2, 0x0, 0xf203, 0x0, 0x40000ec, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @bytecode={0x2, 0x0, 0xc0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x20040}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x74}, {}, {0x0, 0x0, 0x0, 0x4}]}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0xc0, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28, 'rpfilter\x00'}, {0x6}}, @inet=@rpfilter={{0x28, 'rpfilter\x00'}}]}, @unspec=@TRACE={0x20, 'TRACE\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0xfffffffffffffe35) 22:56:24 executing program 4: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) chroot(&(0x7f00000003c0)='./file0/../file0\x00') mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000000)='ramfs\x00', 0x0, 0x0) unshare(0x600) chdir(&(0x7f00000002c0)='./file0\x00') r1 = getpid() r2 = getpid() rt_tgsigqueueinfo(r1, r2, 0x16, &(0x7f0000000000)) ptrace(0x10, r1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3") ptrace$getregset(0x4205, r1, 0x200, &(0x7f00000005c0)={&(0x7f0000001600)=""/4096, 0x1000}) perf_event_open(&(0x7f0000000180)={0x3, 0x70, 0xc, 0x40, 0x0, 0x1, 0x0, 0x53, 0x40, 0x8, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x6, 0x1, @perf_bp={&(0x7f0000000040), 0xa}, 0x1020, 0xfff, 0x7, 0xe, 0x10001, 0x40}, r1, 0x1, 0xffffffffffffffff, 0x1) symlink(&(0x7f0000000140)='..', &(0x7f00000000c0)='./file0\x00') umount2(&(0x7f0000000240)='./file0/../file0\x00', 0x2) fchdir(r0) 22:56:24 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8, 0x3}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f00000041c0)=[{{0x0, 0x0, 0x0}, 0x401}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x4000}, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000003c0)}, 0x0, 0x0, 0x5, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) accept$unix(r3, &(0x7f0000000140), &(0x7f0000000040)=0x6e) prctl$PR_GET_KEEPCAPS(0x7) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="2800000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="b415c75e000000"], 0x28}}, 0x0) [ 969.621170][T30751] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 969.665641][T30765] FAULT_INJECTION: forcing a failure. [ 969.665641][T30765] name failslab, interval 1, probability 0, space 0, times 0 [ 969.678620][T30765] CPU: 0 PID: 30765 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 969.688745][T30765] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 969.698779][T30765] Call Trace: [ 969.702044][T30765] dump_stack+0x1b0/0x21e [ 969.706347][T30765] ? devkmsg_release+0x11c/0x11c [ 969.711253][T30765] ? show_regs_print_info+0x12/0x12 [ 969.716427][T30765] ? __rcu_read_lock+0x50/0x50 [ 969.721164][T30765] ? get_random_u32+0x112/0x210 [ 969.725989][T30765] ? kasan_init_slab_obj+0x20/0x30 [ 969.731126][T30765] should_fail+0x6fb/0x860 [ 969.735522][T30765] ? setup_fault_attr+0x2b0/0x2b0 [ 969.740533][T30765] ? setup_fault_attr+0x2b0/0x2b0 [ 969.745565][T30765] ? ___slab_alloc+0x9b/0x450 [ 969.750211][T30765] ? eth_get_headlen+0x240/0x240 [ 969.755131][T30765] ? tun_get_user+0xc08/0x3400 [ 969.759884][T30765] should_failslab+0x5/0x20 [ 969.764357][T30765] __kmalloc_track_caller+0x5d/0x2b0 [ 969.769639][T30765] ? __napi_alloc_skb+0xd6/0x520 [ 969.774547][T30765] ? tun_get_user+0xc08/0x3400 [ 969.779297][T30765] pskb_expand_head+0x10d/0xfb0 [ 969.784123][T30765] tun_get_user+0xc08/0x3400 [ 969.788684][T30765] ? tun_do_read+0x1f10/0x1f10 [ 969.793429][T30765] ? unwind_get_return_address_ptr+0x130/0x130 [ 969.799569][T30765] ? memset+0x1f/0x40 [ 969.803530][T30765] ? unwind_next_frame+0x1c07/0x22b0 [ 969.808811][T30765] ? __rcu_read_lock+0x50/0x50 [ 969.813553][T30765] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 969.819600][T30765] tun_chr_write_iter+0x121/0x1a0 [ 969.824594][T30765] __vfs_write+0x579/0x700 [ 969.828978][T30765] ? __kernel_write+0x340/0x340 [ 969.833796][T30765] ? __kernel_text_address+0x93/0x110 [ 969.836239][T30772] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. [ 969.839150][T30765] ? stack_trace_save+0x111/0x1e0 [ 969.853350][T30765] __kernel_write+0x12c/0x340 [ 969.858003][T30765] write_pipe_buf+0x148/0x1d0 [ 969.862666][T30765] ? default_file_splice_write+0x240/0x240 [ 969.868454][T30765] ? __rcu_read_lock+0x50/0x50 [ 969.873193][T30765] __splice_from_pipe+0x2d3/0x870 [ 969.878208][T30765] ? default_file_splice_write+0x240/0x240 [ 969.883995][T30765] default_file_splice_write+0x179/0x240 [ 969.889595][T30765] ? default_file_splice_read+0x920/0x920 [ 969.895304][T30765] ? avc_policy_seqno+0x17/0x70 [ 969.900131][T30765] ? security_file_permission+0x128/0x300 [ 969.905820][T30765] ? default_file_splice_read+0x920/0x920 [ 969.911507][T30765] __se_sys_splice+0x860/0x1b90 [ 969.916334][T30765] ? security_file_permission+0x128/0x300 [ 969.922021][T30765] ? fput_many+0x42/0x1a0 [ 969.926335][T30765] ? ksys_write+0x237/0x2a0 [ 969.930805][T30765] ? __x64_sys_splice+0xf0/0xf0 [ 969.935622][T30765] ? __x64_sys_splice+0x1d/0xf0 [ 969.940456][T30765] do_syscall_64+0xcb/0x150 [ 969.944946][T30765] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 969.950805][T30765] RIP: 0033:0x45d5b9 [ 969.954677][T30765] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 969.974269][T30765] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 969.982664][T30765] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 969.990609][T30765] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 969.998567][T30765] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 970.006506][T30765] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000c 22:56:24 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32], 0x20}}, 0x0) 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x4]}}, 0x1c) [ 970.014445][T30765] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:24 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x5]}}, 0x1c) [ 970.057823][T30777] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYRES32=r9], 0x20}}, 0x0) 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x6]}}, 0x1c) 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x7]}}, 0x1c) [ 970.196522][T30787] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYRES32=r9], 0x20}}, 0x0) [ 970.407941][T30795] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:25 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x60) 22:56:25 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x2000}, 0x2}], 0x1, 0x2, 0x0) 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x8]}}, 0x1c) 22:56:25 executing program 2 (fault-call:12 fault-nth:13): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:25 executing program 4: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x0, 0x0) unshare(0x44060400) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) write$P9_RWALK(r1, &(0x7f0000000080)={0x16, 0x6f, 0x1, {0x1, [{0x0, 0x4, 0x2}]}}, 0x16) [ 970.453982][T30769] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x9]}}, 0x1c) 22:56:25 executing program 4: getsockname$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendfile(r2, r1, 0x0, 0x100000001) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r4, 0x407, 0x0) ioctl$sock_SIOCINQ(r4, 0x541b, &(0x7f0000000140)) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x1c, 0x17, 0x209, 0x0, 0x0, {0x4}, [@typed={0x8, 0x18, 0x0, 0x0, @ipv4=@rand_addr=0xcac0f00}]}, 0x1c}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0xa]}}, 0x1c) 22:56:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYRES32=r9], 0x20}}, 0x0) [ 970.579311][T30816] FAULT_INJECTION: forcing a failure. [ 970.579311][T30816] name failslab, interval 1, probability 0, space 0, times 0 [ 970.595075][T30820] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 970.602242][T30816] CPU: 0 PID: 30816 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 970.612387][T30816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 970.622431][T30816] Call Trace: [ 970.625718][T30816] dump_stack+0x1b0/0x21e [ 970.630070][T30816] ? devkmsg_release+0x11c/0x11c [ 970.634997][T30816] ? show_regs_print_info+0x12/0x12 [ 970.640183][T30816] ? __rcu_read_lock+0x50/0x50 [ 970.644932][T30816] ? _raw_spin_lock+0xa1/0x170 [ 970.649700][T30816] ? _raw_spin_trylock_bh+0x190/0x190 [ 970.655064][T30816] should_fail+0x6fb/0x860 [ 970.659468][T30816] ? setup_fault_attr+0x2b0/0x2b0 [ 970.664479][T30816] ? setup_fault_attr+0x2b0/0x2b0 [ 970.669486][T30816] ? eth_get_headlen+0x240/0x240 [ 970.674437][T30816] ? tun_get_user+0xc08/0x3400 [ 970.679190][T30816] should_failslab+0x5/0x20 [ 970.683675][T30816] __kmalloc_track_caller+0x5d/0x2b0 [ 970.688951][T30816] ? __napi_alloc_skb+0xd6/0x520 [ 970.693876][T30816] ? tun_get_user+0xc08/0x3400 [ 970.698630][T30816] pskb_expand_head+0x10d/0xfb0 [ 970.703472][T30816] tun_get_user+0xc08/0x3400 [ 970.708057][T30816] ? tun_do_read+0x1f10/0x1f10 [ 970.712915][T30816] ? unwind_get_return_address_ptr+0x130/0x130 [ 970.719062][T30816] ? memset+0x1f/0x40 [ 970.723033][T30816] ? unwind_next_frame+0x1c07/0x22b0 [ 970.728310][T30816] ? __rcu_read_lock+0x50/0x50 [ 970.733054][T30816] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 970.739116][T30816] tun_chr_write_iter+0x121/0x1a0 [ 970.744134][T30816] __vfs_write+0x579/0x700 [ 970.748552][T30816] ? __kernel_write+0x340/0x340 [ 970.753390][T30816] ? __kernel_text_address+0x93/0x110 [ 970.758756][T30816] ? stack_trace_save+0x111/0x1e0 [ 970.763768][T30816] __kernel_write+0x12c/0x340 [ 970.768436][T30816] write_pipe_buf+0x148/0x1d0 [ 970.773208][T30816] ? default_file_splice_write+0x240/0x240 [ 970.779002][T30816] ? __rcu_read_lock+0x50/0x50 [ 970.783750][T30816] __splice_from_pipe+0x2d3/0x870 [ 970.788764][T30816] ? default_file_splice_write+0x240/0x240 [ 970.794560][T30816] default_file_splice_write+0x179/0x240 [ 970.800199][T30816] ? default_file_splice_read+0x920/0x920 [ 970.805903][T30816] ? avc_policy_seqno+0x17/0x70 [ 970.810743][T30816] ? security_file_permission+0x128/0x300 [ 970.816451][T30816] ? default_file_splice_read+0x920/0x920 [ 970.822150][T30816] __se_sys_splice+0x860/0x1b90 [ 970.826985][T30816] ? security_file_permission+0x128/0x300 [ 970.832694][T30816] ? fput_many+0x42/0x1a0 [ 970.837016][T30816] ? ksys_write+0x237/0x2a0 [ 970.841508][T30816] ? __x64_sys_splice+0xf0/0xf0 [ 970.846342][T30816] ? __x64_sys_splice+0x1d/0xf0 [ 970.851185][T30816] do_syscall_64+0xcb/0x150 [ 970.855678][T30816] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 970.861558][T30816] RIP: 0033:0x45d5b9 [ 970.865444][T30816] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 970.885030][T30816] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 970.893433][T30816] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 970.901395][T30816] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 970.909354][T30816] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 970.917305][T30816] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000d [ 970.925254][T30816] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0xfc]}}, 0x1c) 22:56:25 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r9], 0x20}}, 0x0) 22:56:25 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 971.053287][T30834] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:26 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xee) 22:56:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r9], 0x20}}, 0x0) 22:56:26 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x2]}}, 0x1c) 22:56:26 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9c2c9f717f107137c5dadfff1945282a36"], 0x2}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$SEG6_CMD_DUMPHMAC(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="0811ef00", @ANYRES16=0x0, @ANYBLOB="0000000000000000000002000000080002000000000008000400000000000500050003"], 0x2c}}, 0x0) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000040)}, {&(0x7f0000000000)="0832f497d38350418e4bb321019511dc5df26e9a0b7ecb6974f527cc14538d1efb1ffe03284f6d33265be9c604b293f20e96beeb2aa4c457ac37a3a3f1ce8682500fcecd80", 0x45}], 0x2, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x17) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) r4 = gettid() tkill(r4, 0x800000009) 22:56:26 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x3500}, 0x2}], 0x1, 0x2, 0x0) 22:56:26 executing program 2 (fault-call:12 fault-nth:14): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:26 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'vxcan1\x00', r0}) r1 = add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000440)={'syz'}, &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) perf_event_open(&(0x7f00000000c0)={0x2, 0x70, 0x8, 0x0, 0x16, 0x9, 0x0, 0x9, 0x10, 0x8, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, @perf_config_ext={0x6, 0x7}, 0x2200, 0x552, 0x8, 0x1, 0x80, 0x0, 0x6}, 0xffffffffffffffff, 0xa, 0xffffffffffffffff, 0x1) keyctl$read(0xb, r1, &(0x7f0000000480)=""/40, 0x5ba8) 22:56:26 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x3]}}, 0x1c) 22:56:26 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = dup3(r0, 0xffffffffffffffff, 0x0) unshare(0x44000600) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f00000000c0)="44100903000000000000000100", 0xd) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write$P9_RSTAT(r3, &(0x7f0000000340)={0xea, 0x7d, 0x1, {0x0, 0xe3, 0x7, 0x2d63, {0x40, 0x1, 0x8}, 0x0, 0x3f, 0x9, 0x23, 0xa, '\'}\\((-}%\\[\xf6r\xb5\xa5\xb4m\xf8\xaa\x974\x17JD\x94\xa6G\xe5n\x87A\xdb\x051\xeel\x85\x99D\xace\x10\xb9\xea\xc4\xf1\x1e|\xba\\?V\">\xaf{\xd8\xd7\x1a\xe5\xe0\xfa\xcdA\x01t\x7f\xe9\xa7\x94\x89\xfb(_\xd6;l\xf90\xe9}\xeb\xbf\x14w\x8b f\x81Og\xe0t~VO\x0e\xd5\xecX\xe4q\xa1a\xe1\xad\x16X\x00\xd1!\xf0\x13\x8c\b\xc7b\xa7\x84\x96\xc4\x8c\x9dv^\x16\xd9\x9e\x92\xcb\xe8\xceRG;]e&w\xcdo\x85Ld\xe5v]\xb8\xbc3\x7fxbQ4\x14\xa9Q ', 0x5, '^^*-/', 0x0, '', 0xa1, ')\xf3^\xb5z\xd1\x90\x1c}5z\xce\xc5\x99\xc7)\xdbZ\xa6y\xb5\x86\x9cW\xe3o(_\xab\xf8e(%gO\xd4\x8b9~\x10P\x8be](X\x01\xdc+\xa7\xdf\xf2G\x01mW\xbe\xbf\x8d\x15X\x04x,^\x18[\x00\xf4\xe4\x88\xc09\xfbf1<\xa6tx\xd9\rI\aO\xcf`\xf2\xb7\xa7\x8e+e\x8d\xd0\x14Y\xf5>J3WF\x15\xce\xafT\x85\xa9:\x86\x1a\x10\xe8h\xb8,51W\x89\xbd{\x82^\x89D]G\xf1p\xdd\x10\xfa\xcc\xbe-J\xbaT7\x9aW\x11\x01\x03\xe7\xda@\x00\x00\x00\x00\x00\x00\x00LP->\xa9'}}, 0xffffffffffffffca) write$cgroup_freezer_state(r1, &(0x7f0000000080)='FREEZING\x00', 0x9) [ 971.456435][T30843] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:26 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x4]}}, 0x1c) 22:56:26 executing program 4: getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, &(0x7f00000001c0)={'security\x00', 0x38, "28ee04058be84456b188b398fda61cbc94580dc65db2493a0d538a23d1d5d6578e7af402c4e989ff5caf88ca624caf853eeb015d0edf4ab0"}, &(0x7f0000000000)=0x5c) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000180)={'syzkaller1\x00', 0x8}) getsockopt$IP_SET_OP_VERSION(r0, 0x1, 0x53, &(0x7f0000000100), &(0x7f0000000140)=0x8) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$netlink(0x10, 0x3, 0xa) write$binfmt_misc(r1, &(0x7f0000000400)=ANY=[], 0x10000017e) [ 971.514314][T30867] FAULT_INJECTION: forcing a failure. [ 971.514314][T30867] name failslab, interval 1, probability 0, space 0, times 0 [ 971.526931][T30867] CPU: 0 PID: 30867 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 971.537052][T30867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 971.547098][T30867] Call Trace: [ 971.550361][T30867] dump_stack+0x1b0/0x21e [ 971.554662][T30867] ? devkmsg_release+0x11c/0x11c [ 971.559616][T30867] ? show_regs_print_info+0x12/0x12 [ 971.564782][T30867] ? _raw_spin_lock+0xa1/0x170 [ 971.569516][T30867] ? _raw_spin_trylock_bh+0x190/0x190 [ 971.574874][T30867] ? stack_trace_save+0x111/0x1e0 [ 971.579953][T30867] should_fail+0x6fb/0x860 [ 971.584337][T30867] ? setup_fault_attr+0x2b0/0x2b0 [ 971.589347][T30867] ? eth_get_headlen+0x240/0x240 [ 971.594278][T30867] ? iov_iter_advance+0x707/0xee0 [ 971.599284][T30867] ? __napi_alloc_skb+0xd6/0x520 [ 971.604200][T30867] should_failslab+0x5/0x20 [ 971.608671][T30867] kmem_cache_alloc+0x36/0x250 [ 971.613424][T30867] __napi_alloc_skb+0xd6/0x520 [ 971.618165][T30867] napi_get_frags+0x5c/0x100 [ 971.622725][T30867] tun_get_user+0x9ce/0x3400 [ 971.627290][T30867] ? tun_do_read+0x1f10/0x1f10 [ 971.632029][T30867] ? unwind_get_return_address_ptr+0x130/0x130 [ 971.638165][T30867] ? memset+0x1f/0x40 [ 971.642144][T30867] ? unwind_next_frame+0x1c07/0x22b0 [ 971.647410][T30867] ? __rcu_read_lock+0x50/0x50 [ 971.652142][T30867] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 971.658180][T30867] tun_chr_write_iter+0x121/0x1a0 [ 971.663193][T30867] __vfs_write+0x579/0x700 [ 971.667583][T30867] ? __kernel_write+0x340/0x340 [ 971.672408][T30867] ? __kernel_text_address+0x93/0x110 [ 971.677817][T30867] ? stack_trace_save+0x111/0x1e0 [ 971.682814][T30867] __kernel_write+0x12c/0x340 [ 971.687461][T30867] write_pipe_buf+0x148/0x1d0 [ 971.692106][T30867] ? default_file_splice_write+0x240/0x240 [ 971.697886][T30867] ? __rcu_read_lock+0x50/0x50 [ 971.702628][T30867] __splice_from_pipe+0x2d3/0x870 [ 971.707639][T30867] ? default_file_splice_write+0x240/0x240 [ 971.713419][T30867] default_file_splice_write+0x179/0x240 [ 971.719030][T30867] ? default_file_splice_read+0x920/0x920 [ 971.724720][T30867] ? avc_policy_seqno+0x17/0x70 [ 971.729554][T30867] ? security_file_permission+0x128/0x300 [ 971.735241][T30867] ? default_file_splice_read+0x920/0x920 [ 971.740943][T30867] __se_sys_splice+0x860/0x1b90 [ 971.745766][T30867] ? security_file_permission+0x128/0x300 [ 971.751452][T30867] ? fput_many+0x42/0x1a0 [ 971.755750][T30867] ? ksys_write+0x237/0x2a0 [ 971.760221][T30867] ? __x64_sys_splice+0xf0/0xf0 [ 971.765046][T30867] ? __x64_sys_splice+0x1d/0xf0 [ 971.769882][T30867] do_syscall_64+0xcb/0x150 [ 971.774355][T30867] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 971.780215][T30867] RIP: 0033:0x45d5b9 [ 971.784076][T30867] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 971.803649][T30867] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 22:56:26 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB, @ANYRES32=r9], 0x20}}, 0x0) [ 971.812027][T30867] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 971.819968][T30867] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 971.827916][T30867] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 971.835854][T30867] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000e [ 971.843801][T30867] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 971.880955][T30875] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:27 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xfc) 22:56:27 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x5]}}, 0x1c) 22:56:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d120000", @ANYRES32=r9], 0x20}}, 0x0) 22:56:27 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4000}, 0x2}], 0x1, 0x2, 0x0) 22:56:27 executing program 2 (fault-call:12 fault-nth:15): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:27 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x6]}}, 0x1c) 22:56:27 executing program 4: connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x1, 0x1, 0x3}}, 0x10) unshare(0x44000600) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rtc0\x00', 0x0, 0x0) r1 = syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x9, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getpeername$tipc(r4, &(0x7f0000000180), &(0x7f00000001c0)=0x10) fcntl$setpipe(r3, 0x407, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r3, &(0x7f0000000200)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000900)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES32, @ANYBLOB="000027bd7000ffdbdf250800000005003800000000000500380001000000080032000600000008003b000800000008000300", @ANYRES32=0x0, @ANYRESOCT], 0x5c}, 0x1, 0x0, 0x0, 0x8010}, 0x10) ioctl$RTC_SET_TIME(r1, 0x7003, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='children\x00') bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000680)={r3, 0x10, &(0x7f0000000640)={&(0x7f0000000580)=""/184, 0xb8, 0x0}}, 0x10) pivot_root(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)='./file0\x00') ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000840)={'sit0\x00', &(0x7f00000007c0)={'sit0\x00', 0x0, 0x2f, 0x2, 0x0, 0x400, 0x74, @ipv4={[], [], @private=0xa010100}, @remote, 0x1, 0x80, 0x8, 0x1f}}) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xd, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000008000000000000001f0000001800000000000000000000000900000002b1030001040000850000004700000018250000", @ANYRES32=r6, @ANYBLOB="000000000002000018000000060000000000000008000000180000000000000000000000070000009500000000000000"], &(0x7f0000000480)='syzkaller\x00', 0x75d, 0x2a, &(0x7f00000004c0)=""/42, 0x40f00, 0x2, [], 0x0, 0x15, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0xffffffff, 0x1}, 0x8, 0x10, &(0x7f0000000540)={0x5, 0xe, 0x9, 0x9}, 0x10, r7, r2}, 0x78) r8 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0xd000000, &(0x7f0000000140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r8, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) ioctl$F2FS_IOC_GET_COMPRESS_BLOCKS(r8, 0x8008f511, &(0x7f0000000880)) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1b, 0x0, 0xb9}) [ 972.379694][T30883] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 972.402056][T30895] FAULT_INJECTION: forcing a failure. [ 972.402056][T30895] name failslab, interval 1, probability 0, space 0, times 0 [ 972.416439][T30895] CPU: 1 PID: 30895 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 972.426572][T30895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 972.436655][T30895] Call Trace: [ 972.439919][T30895] dump_stack+0x1b0/0x21e [ 972.444253][T30895] ? devkmsg_release+0x11c/0x11c [ 972.449188][T30895] ? show_regs_print_info+0x12/0x12 [ 972.454363][T30895] ? __rcu_read_lock+0x50/0x50 [ 972.459113][T30895] ? _raw_spin_lock+0xa1/0x170 [ 972.463851][T30895] should_fail+0x6fb/0x860 [ 972.468245][T30895] ? setup_fault_attr+0x2b0/0x2b0 [ 972.473240][T30895] ? setup_fault_attr+0x2b0/0x2b0 [ 972.478235][T30895] ? eth_get_headlen+0x240/0x240 [ 972.483206][T30895] ? tun_get_user+0xc08/0x3400 [ 972.487942][T30895] should_failslab+0x5/0x20 [ 972.492417][T30895] __kmalloc_track_caller+0x5d/0x2b0 [ 972.497674][T30895] ? __napi_alloc_skb+0xd6/0x520 [ 972.502622][T30895] ? tun_get_user+0xc08/0x3400 [ 972.507391][T30895] pskb_expand_head+0x10d/0xfb0 [ 972.512218][T30895] tun_get_user+0xc08/0x3400 [ 972.516777][T30895] ? tun_do_read+0x1f10/0x1f10 [ 972.521508][T30895] ? unwind_get_return_address_ptr+0x130/0x130 [ 972.527628][T30895] ? memset+0x1f/0x40 [ 972.531583][T30895] ? unwind_next_frame+0x1c07/0x22b0 [ 972.536843][T30895] ? __rcu_read_lock+0x50/0x50 [ 972.541621][T30895] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 972.547656][T30895] tun_chr_write_iter+0x121/0x1a0 [ 972.552654][T30895] __vfs_write+0x579/0x700 [ 972.557046][T30895] ? __kernel_write+0x340/0x340 [ 972.561862][T30895] ? __kernel_text_address+0x93/0x110 [ 972.567203][T30895] ? stack_trace_save+0x111/0x1e0 [ 972.572195][T30895] __kernel_write+0x12c/0x340 [ 972.576842][T30895] write_pipe_buf+0x148/0x1d0 [ 972.581490][T30895] ? default_file_splice_write+0x240/0x240 [ 972.587280][T30895] ? __rcu_read_lock+0x50/0x50 [ 972.592013][T30895] __splice_from_pipe+0x2d3/0x870 [ 972.597124][T30895] ? default_file_splice_write+0x240/0x240 [ 972.602897][T30895] default_file_splice_write+0x179/0x240 [ 972.608507][T30895] ? default_file_splice_read+0x920/0x920 [ 972.614203][T30895] ? avc_policy_seqno+0x17/0x70 [ 972.619021][T30895] ? security_file_permission+0x128/0x300 [ 972.624712][T30895] ? default_file_splice_read+0x920/0x920 [ 972.630404][T30895] __se_sys_splice+0x860/0x1b90 [ 972.635225][T30895] ? security_file_permission+0x128/0x300 [ 972.640927][T30895] ? fput_many+0x42/0x1a0 [ 972.645222][T30895] ? ksys_write+0x237/0x2a0 [ 972.649693][T30895] ? __x64_sys_splice+0xf0/0xf0 [ 972.654518][T30895] ? __x64_sys_splice+0x1d/0xf0 [ 972.659351][T30895] do_syscall_64+0xcb/0x150 [ 972.663823][T30895] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 972.669687][T30895] RIP: 0033:0x45d5b9 [ 972.673557][T30895] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 972.693148][T30895] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 972.701531][T30895] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 972.709475][T30895] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 972.717416][T30895] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 972.725381][T30895] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000000f [ 972.733330][T30895] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d120000", @ANYRES32=r9], 0x20}}, 0x0) 22:56:27 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x7]}}, 0x1c) [ 972.844392][T30903] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:27 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x8]}}, 0x1c) 22:56:27 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d120000", @ANYRES32=r9], 0x20}}, 0x0) 22:56:27 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x9]}}, 0x1c) [ 973.016601][T30910] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:28 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x300) 22:56:28 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xa]}}, 0x1c) 22:56:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4002}, 0x2}], 0x1, 0x2, 0x0) 22:56:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200000000000000", @ANYRES32=r9], 0x20}}, 0x0) 22:56:28 executing program 2 (fault-call:12 fault-nth:16): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:28 executing program 4: mkdir(&(0x7f0000000340)='./file0\x00', 0x10) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = openat$cgroup(r0, &(0x7f0000000100)='syz0\x00', 0x200002, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket(0x11, 0x800000003, 0x0) bind(r4, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r4, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="6c00008ff766fa0000fbdbdf250a31b51e000000f66fe1471947fb2d1a41a3e5c14795df971781e39a548fae55d97087632fa28e7b2ab9233ad5e762b840c27affd9b47d11a36e1ca90fcd0987f543196c29cf9693b3f6398009c3a5e9", @ANYRES32=r5, @ANYBLOB="0100000014000100fe8000000000000000000000000000aa14000100fe80000000000000000000000000001d14000100fc0100000000000000000000000000001400010000000000000000000000000000000001"], 0x6c}}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007f1dfd0000b2a4a280930a80000000284308910000000e00080008000c", 0x23}], 0x1}, 0x0) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[], 0xfffffecc) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) r8 = socket$netlink(0x10, 0x3, 0x0) splice(r2, 0x0, r8, 0x0, 0x4ffe0, 0x0) mkdirat$cgroup(r0, &(0x7f0000000180)='syz0\x00', 0x1ff) r9 = fcntl$dupfd(r1, 0x0, r0) r10 = openat$cgroup_procs(r9, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r10, &(0x7f0000000140), 0x12) 22:56:28 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0xfc]}}, 0x1c) [ 973.264593][T30929] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 973.279234][T30936] netlink: 41 bytes leftover after parsing attributes in process `syz-executor.4'. [ 973.317975][T30940] FAULT_INJECTION: forcing a failure. [ 973.317975][T30940] name failslab, interval 1, probability 0, space 0, times 0 [ 973.330928][T30940] CPU: 1 PID: 30940 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 973.341059][T30940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 973.351124][T30940] Call Trace: [ 973.354403][T30940] dump_stack+0x1b0/0x21e [ 973.358747][T30940] ? devkmsg_release+0x11c/0x11c 22:56:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200000000000000", @ANYRES32=r9], 0x20}}, 0x0) [ 973.363652][T30940] ? show_regs_print_info+0x12/0x12 [ 973.368817][T30940] ? __rcu_read_lock+0x50/0x50 [ 973.373574][T30940] ? get_random_u32+0x112/0x210 [ 973.378407][T30940] ? kasan_init_slab_obj+0x20/0x30 [ 973.383492][T30940] should_fail+0x6fb/0x860 [ 973.387889][T30940] ? setup_fault_attr+0x2b0/0x2b0 [ 973.392907][T30940] ? setup_fault_attr+0x2b0/0x2b0 [ 973.397922][T30940] ? eth_get_headlen+0x240/0x240 [ 973.402846][T30940] ? tun_get_user+0xc08/0x3400 [ 973.407597][T30940] should_failslab+0x5/0x20 [ 973.412074][T30940] __kmalloc_track_caller+0x5d/0x2b0 [ 973.417329][T30940] ? __napi_alloc_skb+0xd6/0x520 [ 973.422235][T30940] ? tun_get_user+0xc08/0x3400 [ 973.427014][T30940] pskb_expand_head+0x10d/0xfb0 [ 973.431834][T30940] tun_get_user+0xc08/0x3400 [ 973.436451][T30940] ? tun_do_read+0x1f10/0x1f10 [ 973.441190][T30940] ? unwind_get_return_address_ptr+0x130/0x130 [ 973.447313][T30940] ? memset+0x1f/0x40 [ 973.451301][T30940] ? unwind_next_frame+0x1c07/0x22b0 [ 973.456559][T30940] ? __rcu_read_lock+0x50/0x50 [ 973.461306][T30940] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 973.467348][T30940] tun_chr_write_iter+0x121/0x1a0 [ 973.472350][T30940] __vfs_write+0x579/0x700 [ 973.476741][T30940] ? __kernel_write+0x340/0x340 [ 973.481562][T30940] ? __kernel_text_address+0x93/0x110 [ 973.486907][T30940] ? stack_trace_save+0x111/0x1e0 [ 973.491921][T30940] __kernel_write+0x12c/0x340 [ 973.496570][T30940] write_pipe_buf+0x148/0x1d0 [ 973.501216][T30940] ? default_file_splice_write+0x240/0x240 [ 973.506991][T30940] ? __rcu_read_lock+0x50/0x50 [ 973.511722][T30940] __splice_from_pipe+0x2d3/0x870 [ 973.516716][T30940] ? default_file_splice_write+0x240/0x240 [ 973.522488][T30940] default_file_splice_write+0x179/0x240 [ 973.528088][T30940] ? default_file_splice_read+0x920/0x920 [ 973.533773][T30940] ? avc_policy_seqno+0x17/0x70 [ 973.538592][T30940] ? security_file_permission+0x128/0x300 [ 973.544278][T30940] ? default_file_splice_read+0x920/0x920 [ 973.549979][T30940] __se_sys_splice+0x860/0x1b90 [ 973.554808][T30940] ? security_file_permission+0x128/0x300 [ 973.560499][T30940] ? fput_many+0x42/0x1a0 [ 973.564804][T30940] ? ksys_write+0x237/0x2a0 [ 973.569281][T30940] ? __x64_sys_splice+0xf0/0xf0 [ 973.574110][T30940] ? __x64_sys_splice+0x1d/0xf0 [ 973.578932][T30940] do_syscall_64+0xcb/0x150 [ 973.583407][T30940] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 973.589270][T30940] RIP: 0033:0x45d5b9 [ 973.593134][T30940] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 973.612801][T30940] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 973.621179][T30940] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 973.629123][T30940] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 973.637072][T30940] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 973.645022][T30940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000010 [ 973.652964][T30940] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:28 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 973.669795][T30948] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:28 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x2]}}, 0x1c) 22:56:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200000000000000", @ANYRES32=r9], 0x20}}, 0x0) [ 973.760902][T30954] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/18, @ANYRES32=r9], 0x20}}, 0x0) [ 973.861664][T30960] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:28 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x500) 22:56:28 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x3]}}, 0x1c) 22:56:28 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/18, @ANYRES32=r9], 0x20}}, 0x0) 22:56:28 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4102}, 0x2}], 0x1, 0x2, 0x0) 22:56:28 executing program 2 (fault-call:12 fault-nth:17): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x4]}}, 0x1c) [ 974.179469][T30972] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x5]}}, 0x1c) [ 974.237127][T30980] FAULT_INJECTION: forcing a failure. [ 974.237127][T30980] name failslab, interval 1, probability 0, space 0, times 0 [ 974.264096][T30980] CPU: 0 PID: 30980 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 974.274280][T30980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 974.284349][T30980] Call Trace: [ 974.287633][T30980] dump_stack+0x1b0/0x21e [ 974.291955][T30980] ? devkmsg_release+0x11c/0x11c [ 974.296880][T30980] ? show_regs_print_info+0x12/0x12 [ 974.302065][T30980] ? __rcu_read_lock+0x50/0x50 [ 974.306814][T30980] ? get_random_u32+0x112/0x210 [ 974.311646][T30980] ? kasan_init_slab_obj+0x20/0x30 [ 974.316741][T30980] should_fail+0x6fb/0x860 [ 974.321141][T30980] ? setup_fault_attr+0x2b0/0x2b0 [ 974.326147][T30980] ? setup_fault_attr+0x2b0/0x2b0 [ 974.331159][T30980] ? eth_get_headlen+0x240/0x240 [ 974.336083][T30980] ? tun_get_user+0xc08/0x3400 [ 974.340832][T30980] should_failslab+0x5/0x20 [ 974.345329][T30980] __kmalloc_track_caller+0x5d/0x2b0 [ 974.350598][T30980] ? __napi_alloc_skb+0xd6/0x520 [ 974.355520][T30980] ? tun_get_user+0xc08/0x3400 [ 974.360269][T30980] pskb_expand_head+0x10d/0xfb0 [ 974.365105][T30980] tun_get_user+0xc08/0x3400 [ 974.369688][T30980] ? tun_do_read+0x1f10/0x1f10 [ 974.374439][T30980] ? unwind_get_return_address_ptr+0x130/0x130 [ 974.380581][T30980] ? memset+0x1f/0x40 [ 974.384549][T30980] ? unwind_next_frame+0x1c07/0x22b0 [ 974.389822][T30980] ? __rcu_read_lock+0x50/0x50 [ 974.394600][T30980] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 974.400654][T30980] tun_chr_write_iter+0x121/0x1a0 [ 974.405674][T30980] __vfs_write+0x579/0x700 [ 974.410079][T30980] ? __kernel_write+0x340/0x340 [ 974.414914][T30980] ? __kernel_text_address+0x93/0x110 [ 974.420273][T30980] ? stack_trace_save+0x111/0x1e0 [ 974.425283][T30980] __kernel_write+0x12c/0x340 [ 974.429950][T30980] write_pipe_buf+0x148/0x1d0 [ 974.434613][T30980] ? default_file_splice_write+0x240/0x240 [ 974.440407][T30980] ? __rcu_read_lock+0x50/0x50 [ 974.445162][T30980] __splice_from_pipe+0x2d3/0x870 [ 974.450174][T30980] ? default_file_splice_write+0x240/0x240 [ 974.455971][T30980] default_file_splice_write+0x179/0x240 [ 974.461590][T30980] ? default_file_splice_read+0x920/0x920 [ 974.467302][T30980] ? avc_policy_seqno+0x17/0x70 [ 974.472147][T30980] ? security_file_permission+0x128/0x300 [ 974.477848][T30980] ? default_file_splice_read+0x920/0x920 [ 974.483552][T30980] __se_sys_splice+0x860/0x1b90 [ 974.488392][T30980] ? security_file_permission+0x128/0x300 [ 974.494098][T30980] ? fput_many+0x42/0x1a0 [ 974.498418][T30980] ? ksys_write+0x237/0x2a0 [ 974.502906][T30980] ? __x64_sys_splice+0xf0/0xf0 [ 974.507745][T30980] ? __x64_sys_splice+0x1d/0xf0 [ 974.512591][T30980] do_syscall_64+0xcb/0x150 [ 974.517086][T30980] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 974.522969][T30980] RIP: 0033:0x45d5b9 [ 974.526851][T30980] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 974.546439][T30980] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 974.554839][T30980] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 974.562797][T30980] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 974.570869][T30980] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 974.578830][T30980] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000011 22:56:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/18, @ANYRES32=r9], 0x20}}, 0x0) [ 974.586788][T30980] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x6]}}, 0x1c) [ 974.667983][T30986] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/19, @ANYRES32=r9], 0x20}}, 0x0) 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x7]}}, 0x1c) [ 974.788118][T30993] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x8]}}, 0x1c) 22:56:29 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x9]}}, 0x1c) 22:56:29 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x543) 22:56:29 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/19, @ANYRES32=r9], 0x20}}, 0x0) 22:56:29 executing program 2 (fault-call:12 fault-nth:18): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:29 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4200}, 0x2}], 0x1, 0x2, 0x0) [ 975.116029][T31009] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:30 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xa]}}, 0x1c) [ 975.173007][T31016] FAULT_INJECTION: forcing a failure. [ 975.173007][T31016] name failslab, interval 1, probability 0, space 0, times 0 [ 975.195364][T31016] CPU: 0 PID: 31016 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 975.205520][T31016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 975.215562][T31016] Call Trace: [ 975.218847][T31016] dump_stack+0x1b0/0x21e [ 975.223166][T31016] ? devkmsg_release+0x11c/0x11c [ 975.228091][T31016] ? show_regs_print_info+0x12/0x12 [ 975.233279][T31016] ? __rcu_read_lock+0x50/0x50 [ 975.238030][T31016] ? kasan_init_slab_obj+0x20/0x30 [ 975.243126][T31016] should_fail+0x6fb/0x860 [ 975.247530][T31016] ? setup_fault_attr+0x2b0/0x2b0 [ 975.252539][T31016] ? setup_fault_attr+0x2b0/0x2b0 [ 975.257549][T31016] ? eth_get_headlen+0x240/0x240 [ 975.262476][T31016] ? tun_get_user+0xc08/0x3400 [ 975.267230][T31016] should_failslab+0x5/0x20 [ 975.271727][T31016] __kmalloc_track_caller+0x5d/0x2b0 [ 975.277012][T31016] ? __napi_alloc_skb+0xd6/0x520 [ 975.281938][T31016] ? tun_get_user+0xc08/0x3400 [ 975.286688][T31016] pskb_expand_head+0x10d/0xfb0 [ 975.291535][T31016] tun_get_user+0xc08/0x3400 [ 975.296124][T31016] ? tun_do_read+0x1f10/0x1f10 [ 975.300878][T31016] ? unwind_get_return_address_ptr+0x130/0x130 [ 975.307034][T31016] ? memset+0x1f/0x40 [ 975.311007][T31016] ? unwind_next_frame+0x1c07/0x22b0 [ 975.316283][T31016] ? __rcu_read_lock+0x50/0x50 [ 975.321038][T31016] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 975.327096][T31016] tun_chr_write_iter+0x121/0x1a0 [ 975.332112][T31016] __vfs_write+0x579/0x700 [ 975.336518][T31016] ? __kernel_write+0x340/0x340 [ 975.341353][T31016] ? __kernel_text_address+0x93/0x110 [ 975.346718][T31016] ? stack_trace_save+0x111/0x1e0 [ 975.351738][T31016] __kernel_write+0x12c/0x340 [ 975.356410][T31016] write_pipe_buf+0x148/0x1d0 [ 975.361078][T31016] ? default_file_splice_write+0x240/0x240 [ 975.366872][T31016] ? __rcu_read_lock+0x50/0x50 [ 975.371627][T31016] __splice_from_pipe+0x2d3/0x870 [ 975.376641][T31016] ? default_file_splice_write+0x240/0x240 [ 975.382525][T31016] default_file_splice_write+0x179/0x240 [ 975.388146][T31016] ? default_file_splice_read+0x920/0x920 [ 975.393850][T31016] ? avc_policy_seqno+0x17/0x70 [ 975.398691][T31016] ? security_file_permission+0x128/0x300 [ 975.404395][T31016] ? default_file_splice_read+0x920/0x920 [ 975.410103][T31016] __se_sys_splice+0x860/0x1b90 [ 975.414949][T31016] ? security_file_permission+0x128/0x300 [ 975.420658][T31016] ? fput_many+0x42/0x1a0 [ 975.424979][T31016] ? ksys_write+0x237/0x2a0 [ 975.429470][T31016] ? __x64_sys_splice+0xf0/0xf0 [ 975.434312][T31016] ? __x64_sys_splice+0x1d/0xf0 [ 975.439155][T31016] do_syscall_64+0xcb/0x150 [ 975.443652][T31016] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 975.449618][T31016] RIP: 0033:0x45d5b9 [ 975.453500][T31016] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 975.473096][T31016] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 975.481508][T31016] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 975.489471][T31016] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 975.501862][T31016] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 975.509825][T31016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000012 [ 975.517784][T31016] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec 22:56:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/19, @ANYRES32=r9], 0x20}}, 0x0) 22:56:30 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0xfc]}}, 0x1c) 22:56:30 executing program 4: r0 = syz_genetlink_get_family_id$mptcp(0x0) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1c, r0, 0x4, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x40) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x24, r0, 0x200, 0x70bd2d, 0x0, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x20, r0, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8001) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000000000405e049d004000000004010902240001000000000904000001030100000921000000012201000905810300000000005e0f083b9768815491a2047517b49ff522a88db38a19b35f543b"], 0x0) syz_usb_disconnect(r1) r2 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[], 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x22, 0x1, {[@main]}}, 0x0}, 0x0) r3 = getpid() r4 = getpid() rt_tgsigqueueinfo(r3, r4, 0x16, &(0x7f0000000000)) ptrace(0x10, r3) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)="be9ff483111ec7c05a6e35766a9c5cd98ed812fee8ee677c468e2d01bb01fd560342c1891c9b259ef048c5ac173518e9cd261fa6cbe6a89b00bbcac9c7a8fc13d6d5661f30c63f72be485d2065e695187bb1482dff9c9d341184640629dc64bb37212a404898297b90eb535ba521052c06a3f59c8a96155e941ed41bc723c4062d6dc6418cd0808ff3") ptrace$getregset(0x4205, r3, 0x200, &(0x7f00000005c0)={&(0x7f0000001600)=""/4096, 0x1000}) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000280)={0x0, 0x2, 0x6, 0x852c, r3}) [ 975.581344][T31021] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:30 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:30 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/19, @ANYRES32=r9], 0x20}}, 0x0) [ 975.708170][T31033] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:30 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) 22:56:30 executing program 5 (fault-call:16 fault-nth:0): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 975.810280][T31039] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 975.818660][T31039] FAULT_INJECTION: forcing a failure. [ 975.818660][T31039] name failslab, interval 1, probability 0, space 0, times 0 [ 975.831307][T31039] CPU: 0 PID: 31039 Comm: syz-executor.5 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 975.841428][T31039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 975.851462][T31039] Call Trace: [ 975.854730][T31039] dump_stack+0x1b0/0x21e [ 975.859036][T31039] ? devkmsg_release+0x11c/0x11c [ 975.863831][ T2863] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 975.863956][T31039] ? show_regs_print_info+0x12/0x12 [ 975.876668][T31039] ? netlink_insert+0xb8f/0x1090 [ 975.881590][T31039] ? __rcu_read_lock+0x50/0x50 [ 975.886339][T31039] should_fail+0x6fb/0x860 [ 975.890743][T31039] ? setup_fault_attr+0x2b0/0x2b0 [ 975.895753][T31039] ? netlink_data_ready+0x10/0x10 [ 975.900771][T31039] ? jhash+0x740/0x740 [ 975.904808][T31039] ? netlink_hash+0xd0/0xd0 [ 975.909278][T31039] ? __alloc_skb+0x88/0x4d0 [ 975.913886][T31039] should_failslab+0x5/0x20 [ 975.918359][T31039] kmem_cache_alloc+0x36/0x250 [ 975.923098][T31039] __alloc_skb+0x88/0x4d0 [ 975.927397][T31039] ? netlink_autobind+0x163/0x190 [ 975.932393][T31039] netlink_sendmsg+0x73b/0xd40 [ 975.937136][T31039] ? netlink_getsockopt+0x8e0/0x8e0 [ 975.942307][T31039] ? security_socket_sendmsg+0xad/0xc0 [ 975.947768][T31039] ? netlink_getsockopt+0x8e0/0x8e0 [ 975.952943][T31039] ____sys_sendmsg+0x56f/0x860 [ 975.957703][T31039] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 975.962871][T31039] __sys_sendmsg+0x26a/0x350 [ 975.967429][T31039] ? ____sys_sendmsg+0x860/0x860 [ 975.972338][T31039] ? __fsnotify_parent+0x300/0x300 [ 975.977440][T31039] ? security_file_permission+0x128/0x300 [ 975.983134][T31039] ? __sb_end_write+0xa4/0xf0 [ 975.987791][T31039] ? vfs_write+0x427/0x4f0 [ 975.992177][T31039] do_syscall_64+0xcb/0x150 [ 975.996666][T31039] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.002546][T31039] RIP: 0033:0x45d5b9 [ 976.006414][T31039] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 976.025985][T31039] RSP: 002b:00007f16e1d8ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 976.034362][T31039] RAX: ffffffffffffffda RBX: 000000000002ce80 RCX: 000000000045d5b9 [ 976.042302][T31039] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 000000000000000a [ 976.050260][T31039] RBP: 00007f16e1d8aca0 R08: 0000000000000000 R09: 0000000000000000 22:56:30 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x608) 22:56:30 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x4800}, 0x2}], 0x1, 0x2, 0x0) [ 976.058216][T31039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 976.066159][T31039] R13: 00007ffda3e9751f R14: 00007f16e1d8b9c0 R15: 000000000118cf4c 22:56:31 executing program 2 (fault-call:12 fault-nth:19): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) 22:56:31 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) 22:56:31 executing program 5 (fault-call:16 fault-nth:1): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:31 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) [ 976.223801][ T2863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 976.234915][ T2863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 976.236303][T31058] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 976.252002][T31060] FAULT_INJECTION: forcing a failure. [ 976.252002][T31060] name failslab, interval 1, probability 0, space 0, times 0 [ 976.256402][T31058] FAULT_INJECTION: forcing a failure. [ 976.256402][T31058] name failslab, interval 1, probability 0, space 0, times 0 [ 976.265681][T31060] CPU: 1 PID: 31060 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 976.265686][T31060] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 976.265689][T31060] Call Trace: [ 976.265702][T31060] dump_stack+0x1b0/0x21e [ 976.265711][T31060] ? devkmsg_release+0x11c/0x11c [ 976.265718][T31060] ? show_regs_print_info+0x12/0x12 [ 976.265725][T31060] ? _raw_spin_lock+0xa1/0x170 [ 976.265732][T31060] ? _raw_spin_trylock_bh+0x190/0x190 [ 976.265740][T31060] should_fail+0x6fb/0x860 [ 976.265747][T31060] ? setup_fault_attr+0x2b0/0x2b0 [ 976.265755][T31060] ? eth_get_headlen+0x240/0x240 [ 976.265764][T31060] ? iov_iter_advance+0x707/0xee0 [ 976.265773][T31060] ? __napi_alloc_skb+0xd6/0x520 [ 976.265780][T31060] should_failslab+0x5/0x20 [ 976.265788][T31060] kmem_cache_alloc+0x36/0x250 [ 976.265796][T31060] __napi_alloc_skb+0xd6/0x520 [ 976.265806][T31060] napi_get_frags+0x5c/0x100 [ 976.265814][T31060] tun_get_user+0x9ce/0x3400 [ 976.265827][T31060] ? tun_do_read+0x1f10/0x1f10 [ 976.265838][T31060] ? unwind_get_return_address_ptr+0x130/0x130 [ 976.265847][T31060] ? memset+0x1f/0x40 [ 976.265855][T31060] ? unwind_next_frame+0x1c07/0x22b0 [ 976.265864][T31060] ? __rcu_read_lock+0x50/0x50 [ 976.265872][T31060] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.265880][T31060] tun_chr_write_iter+0x121/0x1a0 [ 976.265889][T31060] __vfs_write+0x579/0x700 [ 976.265897][T31060] ? __kernel_write+0x340/0x340 [ 976.265905][T31060] ? __kernel_text_address+0x93/0x110 [ 976.265916][T31060] ? stack_trace_save+0x111/0x1e0 [ 976.265925][T31060] __kernel_write+0x12c/0x340 [ 976.265934][T31060] write_pipe_buf+0x148/0x1d0 [ 976.265942][T31060] ? default_file_splice_write+0x240/0x240 [ 976.265949][T31060] ? __rcu_read_lock+0x50/0x50 [ 976.265957][T31060] __splice_from_pipe+0x2d3/0x870 [ 976.265967][T31060] ? default_file_splice_write+0x240/0x240 [ 976.265976][T31060] default_file_splice_write+0x179/0x240 [ 976.265984][T31060] ? default_file_splice_read+0x920/0x920 [ 976.265991][T31060] ? avc_policy_seqno+0x17/0x70 [ 976.266002][T31060] ? security_file_permission+0x128/0x300 [ 976.266007][T31060] ? default_file_splice_read+0x920/0x920 [ 976.266014][T31060] __se_sys_splice+0x860/0x1b90 [ 976.266023][T31060] ? security_file_permission+0x128/0x300 [ 976.266031][T31060] ? fput_many+0x42/0x1a0 [ 976.266039][T31060] ? ksys_write+0x237/0x2a0 [ 976.266046][T31060] ? __x64_sys_splice+0xf0/0xf0 [ 976.266053][T31060] ? __x64_sys_splice+0x1d/0xf0 [ 976.266061][T31060] do_syscall_64+0xcb/0x150 [ 976.266069][T31060] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.266077][T31060] RIP: 0033:0x45d5b9 [ 976.266085][T31060] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 976.266089][T31060] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 976.266097][T31060] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 976.266102][T31060] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 976.266107][T31060] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 976.266111][T31060] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000013 [ 976.266115][T31060] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 976.323834][ T2863] usb 5-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.40 [ 976.337016][T31058] CPU: 0 PID: 31058 Comm: syz-executor.5 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 976.341536][ T2863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 976.346226][T31058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 976.346229][T31058] Call Trace: [ 976.346243][T31058] dump_stack+0x1b0/0x21e [ 976.346252][T31058] ? devkmsg_release+0x11c/0x11c [ 976.346262][T31058] ? show_regs_print_info+0x12/0x12 [ 976.353342][ T2863] usb 5-1: SerialNumber: syz [ 976.355653][T31058] ? netlink_insert+0xb8f/0x1090 [ 976.355663][T31058] ? __rcu_read_lock+0x50/0x50 [ 976.355670][T31058] should_fail+0x6fb/0x860 [ 976.355680][T31058] ? setup_fault_attr+0x2b0/0x2b0 [ 976.363931][ T2863] usb 5-1: config 0 descriptor?? [ 976.365157][T31058] ? ___slab_alloc+0x9b/0x450 [ 976.686132][T31058] ? jhash+0x740/0x740 [ 976.690166][T31058] ? netlink_hash+0xd0/0xd0 [ 976.694649][T31058] ? netlink_sendmsg+0x73b/0xd40 [ 976.699551][T31058] should_failslab+0x5/0x20 [ 976.704018][T31058] __kmalloc_track_caller+0x5d/0x2b0 [ 976.709271][T31058] ? kmem_cache_alloc+0x1d5/0x250 [ 976.714282][T31058] ? netlink_sendmsg+0x73b/0xd40 [ 976.719187][T31058] __alloc_skb+0xd1/0x4d0 [ 976.723481][T31058] ? netlink_autobind+0x163/0x190 [ 976.728484][T31058] netlink_sendmsg+0x73b/0xd40 [ 976.733215][T31058] ? netlink_getsockopt+0x8e0/0x8e0 [ 976.738380][T31058] ? security_socket_sendmsg+0xad/0xc0 [ 976.743839][T31058] ? netlink_getsockopt+0x8e0/0x8e0 [ 976.743852][ T2863] usbhid 5-1:0.0: can't add hid device: -71 [ 976.749027][T31058] ____sys_sendmsg+0x56f/0x860 [ 976.755000][ T2863] usbhid: probe of 5-1:0.0 failed with error -71 [ 976.759635][T31058] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 976.770956][ T2863] usb 5-1: USB disconnect, device number 83 [ 976.771127][T31058] __sys_sendmsg+0x26a/0x350 [ 976.781553][T31058] ? ____sys_sendmsg+0x860/0x860 [ 976.786473][T31058] ? __fsnotify_parent+0x300/0x300 [ 976.791557][T31058] ? security_file_permission+0x128/0x300 [ 976.797241][T31058] ? __sb_end_write+0xa4/0xf0 [ 976.801884][T31058] ? vfs_write+0x427/0x4f0 [ 976.806268][T31058] do_syscall_64+0xcb/0x150 [ 976.810752][T31058] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 976.816627][T31058] RIP: 0033:0x45d5b9 [ 976.820490][T31058] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 976.840091][T31058] RSP: 002b:00007f16e1d8ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 976.848470][T31058] RAX: ffffffffffffffda RBX: 000000000002ce80 RCX: 000000000045d5b9 [ 976.856407][T31058] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 000000000000000a [ 976.864345][T31058] RBP: 00007f16e1d8aca0 R08: 0000000000000000 R09: 0000000000000000 22:56:31 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) [ 976.872280][T31058] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 976.880219][T31058] R13: 00007ffda3e9751f R14: 00007f16e1d8b9c0 R15: 000000000118cf4c [ 977.193712][ T2863] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 977.553769][ T2863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 977.564637][ T2863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 977.653792][ T2863] usb 5-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.40 [ 977.662824][ T2863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 977.670810][ T2863] usb 5-1: SerialNumber: syz [ 977.675962][ T2863] usb 5-1: config 0 descriptor?? [ 978.083679][ T2863] usbhid 5-1:0.0: can't add hid device: -71 [ 978.089673][ T2863] usbhid: probe of 5-1:0.0 failed with error -71 [ 978.097670][ T2863] usb 5-1: USB disconnect, device number 84 [ 978.723613][ T135] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 979.083690][ T135] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 979.094599][ T135] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 979.183669][ T135] usb 5-1: New USB device found, idVendor=045e, idProduct=009d, bcdDevice= 0.40 [ 979.192750][ T135] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=4 [ 979.201276][ T135] usb 5-1: SerialNumber: syz [ 979.206708][ T135] usb 5-1: config 0 descriptor?? 22:56:34 executing program 4: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@mcast2}, 0x9) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) write(0xffffffffffffffff, &(0x7f0000000300)="240000001a005f0014f90800000004000200000000000000000e008008001b0001", 0x21) close(r2) write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[], 0xfffffecc) socket$netlink(0x10, 0x3, 0x0) splice(r0, 0x0, r2, 0x0, 0x4ff60, 0x0) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r5, 0x407, 0x0) r6 = accept4$tipc(r4, &(0x7f0000000080)=@id, &(0x7f0000000100)=0x10, 0x80000) copy_file_range(r5, &(0x7f0000000040)=0xfff, r6, &(0x7f0000000140)=0x2, 0xfffffffffffffff8, 0x0) 22:56:34 executing program 5 (fault-call:16 fault-nth:2): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:34 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x5900}, 0x2}], 0x1, 0x2, 0x0) 22:56:34 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x689) 22:56:34 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) 22:56:34 executing program 2 (fault-call:12 fault-nth:20): pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 979.368856][T31086] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:34 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) [ 979.413833][T31086] FAULT_INJECTION: forcing a failure. [ 979.413833][T31086] name failslab, interval 1, probability 0, space 0, times 0 [ 979.427384][T31086] CPU: 0 PID: 31086 Comm: syz-executor.5 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 979.437561][T31086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 979.447598][T31086] Call Trace: [ 979.450989][T31086] dump_stack+0x1b0/0x21e [ 979.455295][T31086] ? devkmsg_release+0x11c/0x11c [ 979.458917][T31099] FAULT_INJECTION: forcing a failure. [ 979.458917][T31099] name failslab, interval 1, probability 0, space 0, times 0 [ 979.460210][T31086] ? show_regs_print_info+0x12/0x12 [ 979.460219][T31086] ? insert_header+0xde0/0xde0 [ 979.460233][T31086] should_fail+0x6fb/0x860 [ 979.487102][T31086] ? setup_fault_attr+0x2b0/0x2b0 [ 979.492102][T31086] ? drop_sysctl_table+0x6ef/0x850 [ 979.497185][T31086] ? _local_bh_enable+0x30/0x30 [ 979.502011][T31086] ? __alloc_skb+0x88/0x4d0 [ 979.506482][T31086] should_failslab+0x5/0x20 [ 979.510957][T31086] kmem_cache_alloc+0x36/0x250 [ 979.515700][T31086] __alloc_skb+0x88/0x4d0 [ 979.519997][T31086] ? kfree+0x12b/0x5d0 [ 979.524076][T31086] inet_netconf_notify_devconf+0x163/0x220 [ 979.529860][T31086] inetdev_event+0x7a6/0x1040 [ 979.534511][T31086] ? ipv4_doint_and_flush+0x130/0x130 [ 979.539862][T31086] ? skb_dequeue+0x10e/0x140 [ 979.544420][T31086] ? wext_netdev_notifier_call+0x108/0x140 [ 979.550197][T31086] raw_notifier_call_chain+0x9e/0x100 [ 979.555541][T31086] rollback_registered_many+0xcf6/0x1380 [ 979.561154][T31086] ? tun_net_mclist+0x10/0x10 [ 979.565799][T31086] ? unregister_netdevice_many+0x260/0x260 [ 979.571572][T31086] ? memset+0x1f/0x40 [ 979.575523][T31086] ? __nla_validate_parse+0x18fd/0x2010 [ 979.581037][T31086] ? __perf_event_task_sched_in+0x4ed/0x550 [ 979.586899][T31086] ? perf_pmu_sched_task+0x370/0x370 [ 979.592154][T31086] ? __nla_validate+0x50/0x50 [ 979.596802][T31086] ? unregister_netdevice_queue+0x277/0x500 [ 979.602662][T31086] ? finish_task_switch+0x2be/0x4c0 [ 979.607830][T31086] ? alloc_netdev_mqs+0xc60/0xc60 [ 979.612824][T31086] unregister_netdevice_many+0x46/0x260 [ 979.618339][T31086] ? alloc_netdev_mqs+0xc60/0xc60 [ 979.623331][T31086] rtnl_dellink+0x59a/0xb00 [ 979.627803][T31086] ? rtnl_newlink+0x1d90/0x1d90 [ 979.632621][T31086] ? _raw_spin_lock+0xa1/0x170 [ 979.637354][T31086] ? _raw_spin_trylock_bh+0x190/0x190 [ 979.642713][T31086] ? mutex_trylock+0xb0/0xb0 [ 979.647286][T31086] ? security_capable+0xb1/0xd0 [ 979.652112][T31086] ? rtnl_newlink+0x1d90/0x1d90 [ 979.656932][T31086] rtnetlink_rcv_msg+0x936/0xc20 [ 979.661853][T31086] ? is_bpf_text_address+0x290/0x2b0 [ 979.667109][T31086] ? rtnetlink_bind+0x80/0x80 [ 979.671753][T31086] ? unwind_get_return_address+0x48/0x90 [ 979.677357][T31086] ? arch_stack_walk+0x98/0xe0 [ 979.682091][T31086] ? stack_trace_save+0x111/0x1e0 [ 979.687086][T31086] ? stack_trace_snprint+0x150/0x150 [ 979.692340][T31086] ? _raw_spin_lock_bh+0xa4/0x180 [ 979.697347][T31086] ? rhashtable_jhash2+0x1cf/0x2f0 [ 979.702427][T31086] ? jhash+0x740/0x740 [ 979.706465][T31086] ? rht_key_hashfn+0x157/0x240 [ 979.711286][T31086] ? deferred_put_nlk_sk+0x210/0x210 [ 979.716537][T31086] ? netlink_sendmsg+0x73b/0xd40 [ 979.721444][T31086] ? jhash+0x740/0x740 [ 979.725491][T31086] ? netlink_hash+0xd0/0xd0 [ 979.729964][T31086] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 979.736007][T31086] ? _raw_spin_lock_irq+0x180/0x180 [ 979.741185][T31086] ? __rcu_read_lock+0x50/0x50 [ 979.745920][T31086] netlink_rcv_skb+0x1f0/0x460 [ 979.750652][T31086] ? rtnetlink_bind+0x80/0x80 [ 979.755300][T31086] ? netlink_ack+0xa90/0xa90 [ 979.759859][T31086] ? __rcu_read_lock+0x50/0x50 [ 979.764594][T31086] ? selinux_vm_enough_memory+0x160/0x160 [ 979.770292][T31086] ? setup_fault_attr+0x2b0/0x2b0 [ 979.775286][T31086] ? netlink_trim+0x10a/0x230 [ 979.779930][T31086] netlink_unicast+0x87c/0xa20 [ 979.784665][T31086] ? netlink_detachskb+0x60/0x60 [ 979.789585][T31086] ? __virt_addr_valid+0x1fd/0x290 [ 979.794668][T31086] netlink_sendmsg+0x9a7/0xd40 [ 979.799423][T31086] ? netlink_getsockopt+0x8e0/0x8e0 [ 979.804592][T31086] ? security_socket_sendmsg+0xad/0xc0 [ 979.810020][T31086] ? netlink_getsockopt+0x8e0/0x8e0 [ 979.815187][T31086] ____sys_sendmsg+0x56f/0x860 [ 979.819927][T31086] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 979.825097][T31086] __sys_sendmsg+0x26a/0x350 [ 979.829658][T31086] ? ____sys_sendmsg+0x860/0x860 [ 979.834568][T31086] ? __fsnotify_parent+0x300/0x300 [ 979.839650][T31086] ? security_file_permission+0x128/0x300 [ 979.845348][T31086] ? __sb_end_write+0xa4/0xf0 [ 979.850004][T31086] ? vfs_write+0x427/0x4f0 [ 979.854392][T31086] do_syscall_64+0xcb/0x150 [ 979.858877][T31086] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 979.864758][T31086] RIP: 0033:0x45d5b9 [ 979.868622][T31086] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 979.888203][T31086] RSP: 002b:00007f16e1d8ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 979.896593][T31086] RAX: ffffffffffffffda RBX: 000000000002ce80 RCX: 000000000045d5b9 [ 979.904540][T31086] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 000000000000000a [ 979.912483][T31086] RBP: 00007f16e1d8aca0 R08: 0000000000000000 R09: 0000000000000000 [ 979.920423][T31086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 979.928368][T31086] R13: 00007ffda3e9751f R14: 00007f16e1d8b9c0 R15: 000000000118cf4c [ 979.936335][T31099] CPU: 1 PID: 31099 Comm: syz-executor.2 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 979.946475][T31099] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 979.955636][T31101] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=31101 comm=syz-executor.4 [ 979.956514][T31099] Call Trace: [ 979.956529][T31099] dump_stack+0x1b0/0x21e [ 979.956538][T31099] ? devkmsg_release+0x11c/0x11c [ 979.956544][T31099] ? show_regs_print_info+0x12/0x12 [ 979.956559][T31099] ? netif_receive_skb_list_internal+0x46a/0x720 [ 979.969679][T31101] netlink: 'syz-executor.4': attribute type 27 has an invalid length. [ 979.972570][T31099] should_fail+0x6fb/0x860 [ 979.972579][T31099] ? setup_fault_attr+0x2b0/0x2b0 [ 979.972588][T31099] ? eth_get_headlen+0x240/0x240 [ 979.972596][T31099] ? iov_iter_advance+0x707/0xee0 [ 979.972607][T31099] ? __napi_alloc_skb+0xd6/0x520 [ 980.025591][T31099] should_failslab+0x5/0x20 [ 980.030063][T31099] kmem_cache_alloc+0x36/0x250 [ 980.034805][T31099] __napi_alloc_skb+0xd6/0x520 [ 980.039553][T31099] napi_get_frags+0x5c/0x100 [ 980.044119][T31099] tun_get_user+0x9ce/0x3400 [ 980.048722][T31099] ? tun_do_read+0x1f10/0x1f10 [ 980.053454][T31099] ? unwind_get_return_address_ptr+0x130/0x130 [ 980.059575][T31099] ? memset+0x1f/0x40 [ 980.063529][T31099] ? unwind_next_frame+0x1c07/0x22b0 [ 980.068786][T31099] ? __rcu_read_lock+0x50/0x50 [ 980.073523][T31099] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.079562][T31099] tun_chr_write_iter+0x121/0x1a0 [ 980.084653][T31099] __vfs_write+0x579/0x700 [ 980.089042][T31099] ? __kernel_write+0x340/0x340 [ 980.093860][T31099] ? __kernel_text_address+0x93/0x110 [ 980.099210][T31099] ? stack_trace_save+0x111/0x1e0 [ 980.104295][T31099] __kernel_write+0x12c/0x340 [ 980.108945][T31099] write_pipe_buf+0x148/0x1d0 [ 980.113618][T31099] ? default_file_splice_write+0x240/0x240 [ 980.119395][T31099] ? __rcu_read_lock+0x50/0x50 [ 980.124129][T31099] __splice_from_pipe+0x2d3/0x870 [ 980.129126][T31099] ? default_file_splice_write+0x240/0x240 [ 980.134898][T31099] default_file_splice_write+0x179/0x240 [ 980.140498][T31099] ? default_file_splice_read+0x920/0x920 [ 980.146187][T31099] ? avc_policy_seqno+0x17/0x70 [ 980.151016][T31099] ? security_file_permission+0x128/0x300 [ 980.156701][T31099] ? default_file_splice_read+0x920/0x920 [ 980.162395][T31099] __se_sys_splice+0x860/0x1b90 22:56:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x6801}, 0x2}], 0x1, 0x2, 0x0) [ 980.167233][T31099] ? security_file_permission+0x128/0x300 [ 980.172936][T31099] ? fput_many+0x42/0x1a0 [ 980.177251][T31099] ? ksys_write+0x237/0x2a0 [ 980.181737][T31099] ? __x64_sys_splice+0xf0/0xf0 [ 980.186565][T31099] ? __x64_sys_splice+0x1d/0xf0 [ 980.191399][T31099] do_syscall_64+0xcb/0x150 [ 980.195887][T31099] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.201768][T31099] RIP: 0033:0x45d5b9 [ 980.205647][T31099] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 980.225229][T31099] RSP: 002b:00007f45a4fefc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 980.233609][T31099] RAX: ffffffffffffffda RBX: 0000000000033980 RCX: 000000000045d5b9 [ 980.241550][T31099] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 980.249499][T31099] RBP: 00007f45a4fefca0 R08: 0000000000018100 R09: 0000000000000000 [ 980.257440][T31099] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000014 22:56:35 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000880)={{}, 'syz1\x00', 0x7}) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x3f, 0x0) dup2(r0, r1) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000200), &(0x7f0000000280)=0x6e, 0x800) shutdown(r3, 0x1) fcntl$setpipe(r2, 0x407, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/urandom\x00', 0x4100, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, 0x2, 0x9, 0x201, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFCTH_STATUS={0x8, 0x6, 0x1, 0x0, 0x1}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x8}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x1f}, @NFCTH_PRIV_DATA_LEN={0x8, 0x5, 0x1, 0x0, 0x14}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x8001}}, @NFCTH_STATUS={0x8}]}, 0x54}, 0x1, 0x0, 0x0, 0x200048c5}, 0x40) 22:56:35 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x8]}}, 0x1c) [ 980.265828][T31099] R13: 00007ffe98dec43f R14: 00007f45a4ff09c0 R15: 000000000118cfec [ 980.300828][T31110] input: syz1 as /devices/virtual/input/input98 [ 980.307251][ T135] usbhid 5-1:0.0: can't add hid device: -71 [ 980.313184][ T135] usbhid: probe of 5-1:0.0 failed with error -71 [ 980.321299][T31086] ================================================================== [ 980.329368][T31086] BUG: KASAN: use-after-free in free_netdev+0x176/0x300 [ 980.336272][T31086] Read of size 8 at addr ffff88818f000538 by task syz-executor.5/31086 [ 980.344473][T31086] [ 980.346778][T31086] CPU: 0 PID: 31086 Comm: syz-executor.5 Not tainted 5.4.63-syzkaller-01129-gc99fd3bf1076 #0 [ 980.356887][T31086] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 980.366923][T31086] Call Trace: [ 980.370183][T31086] dump_stack+0x1b0/0x21e [ 980.374479][T31086] ? show_regs_print_info+0x12/0x12 [ 980.379644][T31086] ? printk+0xc0/0x104 [ 980.383682][T31086] print_address_description+0x96/0x5d0 [ 980.389198][T31086] ? devkmsg_release+0x11c/0x11c [ 980.394103][T31086] ? slab_free_freelist_hook+0xd0/0x150 [ 980.399632][T31086] ? call_rcu+0x10/0x10 [ 980.403754][T31086] __kasan_report+0x14b/0x1c0 [ 980.408398][T31086] ? free_netdev+0x176/0x300 [ 980.412953][T31086] kasan_report+0x27/0x50 [ 980.417252][T31086] free_netdev+0x176/0x300 [ 980.421636][T31086] netdev_run_todo+0xbc4/0xe00 [ 980.426368][T31086] ? netdev_refcnt_read+0x1a0/0x1a0 [ 980.431545][T31086] ? mutex_trylock+0xb0/0xb0 [ 980.436104][T31086] rtnetlink_rcv_msg+0x963/0xc20 [ 980.441008][T31086] ? is_bpf_text_address+0x290/0x2b0 [ 980.446262][T31086] ? rtnetlink_bind+0x80/0x80 [ 980.451002][T31086] ? unwind_get_return_address+0x48/0x90 [ 980.456602][T31086] ? arch_stack_walk+0x98/0xe0 [ 980.461335][T31086] ? stack_trace_save+0x111/0x1e0 [ 980.466341][T31086] ? stack_trace_snprint+0x150/0x150 [ 980.471601][T31086] ? _raw_spin_lock_bh+0xa4/0x180 [ 980.476598][T31086] ? rhashtable_jhash2+0x1cf/0x2f0 [ 980.481680][T31086] ? jhash+0x740/0x740 [ 980.485721][T31086] ? rht_key_hashfn+0x157/0x240 [ 980.490553][T31086] ? deferred_put_nlk_sk+0x210/0x210 [ 980.495813][T31086] ? netlink_sendmsg+0x73b/0xd40 [ 980.500720][T31086] ? jhash+0x740/0x740 [ 980.504766][T31086] ? netlink_hash+0xd0/0xd0 [ 980.509256][T31086] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.515307][T31086] ? _raw_spin_lock_irq+0x180/0x180 [ 980.520481][T31086] ? __rcu_read_lock+0x50/0x50 [ 980.525216][T31086] netlink_rcv_skb+0x1f0/0x460 [ 980.529949][T31086] ? rtnetlink_bind+0x80/0x80 [ 980.534592][T31086] ? netlink_ack+0xa90/0xa90 [ 980.539149][T31086] ? __rcu_read_lock+0x50/0x50 [ 980.543881][T31086] ? selinux_vm_enough_memory+0x160/0x160 [ 980.549569][T31086] ? setup_fault_attr+0x2b0/0x2b0 [ 980.554560][T31086] ? netlink_trim+0x10a/0x230 [ 980.559223][T31086] netlink_unicast+0x87c/0xa20 [ 980.563973][T31086] ? netlink_detachskb+0x60/0x60 [ 980.568888][T31086] ? __virt_addr_valid+0x1fd/0x290 [ 980.573973][T31086] netlink_sendmsg+0x9a7/0xd40 [ 980.578708][T31086] ? netlink_getsockopt+0x8e0/0x8e0 [ 980.583879][T31086] ? security_socket_sendmsg+0xad/0xc0 [ 980.589320][T31086] ? netlink_getsockopt+0x8e0/0x8e0 [ 980.594495][T31086] ____sys_sendmsg+0x56f/0x860 [ 980.599229][T31086] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 980.604396][T31086] __sys_sendmsg+0x26a/0x350 [ 980.608963][T31086] ? ____sys_sendmsg+0x860/0x860 [ 980.613873][T31086] ? __fsnotify_parent+0x300/0x300 [ 980.618951][T31086] ? security_file_permission+0x128/0x300 [ 980.624636][T31086] ? __sb_end_write+0xa4/0xf0 [ 980.629281][T31086] ? vfs_write+0x427/0x4f0 [ 980.633672][T31086] do_syscall_64+0xcb/0x150 [ 980.638144][T31086] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.644003][T31086] RIP: 0033:0x45d5b9 [ 980.647869][T31086] Code: 5d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 980.667463][T31086] RSP: 002b:00007f16e1d8ac78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 980.675949][T31086] RAX: ffffffffffffffda RBX: 000000000002ce80 RCX: 000000000045d5b9 [ 980.683895][T31086] RDX: 0000000000000000 RSI: 0000000020000140 RDI: 000000000000000a [ 980.691833][T31086] RBP: 00007f16e1d8aca0 R08: 0000000000000000 R09: 0000000000000000 [ 980.699773][T31086] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 980.707727][T31086] R13: 00007ffda3e9751f R14: 00007f16e1d8b9c0 R15: 000000000118cf4c [ 980.715674][T31086] [ 980.717973][T31086] Allocated by task 31086: [ 980.722370][T31086] __kasan_kmalloc+0x117/0x1b0 [ 980.727101][T31086] __kmalloc+0xf7/0x2c0 [ 980.731226][T31086] sk_prot_alloc+0xd6/0x290 [ 980.735709][T31086] sk_alloc+0x33/0x340 [ 980.739745][T31086] tun_chr_open+0x77/0x4a0 [ 980.744130][T31086] misc_open+0x356/0x3d0 [ 980.748338][T31086] chrdev_open+0x60a/0x670 [ 980.752719][T31086] do_dentry_open+0x8fa/0x1070 [ 980.757450][T31086] path_openat+0x1681/0x42d0 [ 980.762006][T31086] do_filp_open+0x1f7/0x430 [ 980.766482][T31086] do_sys_open+0x36f/0x7a0 [ 980.770879][T31086] do_syscall_64+0xcb/0x150 [ 980.775350][T31086] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.781209][T31086] [ 980.783505][T31086] Freed by task 31081: [ 980.787540][T31086] __kasan_slab_free+0x168/0x220 [ 980.792456][T31086] slab_free_freelist_hook+0xd0/0x150 [ 980.797793][T31086] kfree+0x12b/0x5d0 [ 980.801654][T31086] __sk_destruct+0x3f9/0x480 [ 980.806209][T31086] tun_chr_close+0xb4/0xd0 [ 980.810590][T31086] __fput+0x27d/0x6c0 [ 980.814537][T31086] task_work_run+0x176/0x1a0 [ 980.819093][T31086] prepare_exit_to_usermode+0x286/0x2e0 [ 980.824608][T31086] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 980.830462][T31086] [ 980.832759][T31086] The buggy address belongs to the object at ffff88818f000000 [ 980.832759][T31086] which belongs to the cache kmalloc-2k of size 2048 [ 980.846779][T31086] The buggy address is located 1336 bytes inside of [ 980.846779][T31086] 2048-byte region [ffff88818f000000, ffff88818f000800) [ 980.860189][T31086] The buggy address belongs to the page: [ 980.865790][T31086] page:ffffea00063c0000 refcount:1 mapcount:0 mapping:ffff8881da80c000 index:0xffff88818f001000 compound_mapcount: 0 [ 980.877984][T31086] flags: 0x8000000000010200(slab|head) [ 980.883423][T31086] raw: 8000000000010200 ffffea0007298008 ffffea000640f808 ffff8881da80c000 [ 980.891982][T31086] raw: ffff88818f001000 0000000000080007 00000001ffffffff 0000000000000000 [ 980.900529][T31086] page dumped because: kasan: bad access detected [ 980.906904][T31086] [ 980.909199][T31086] Memory state around the buggy address: [ 980.914797][T31086] ffff88818f000400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 980.922841][T31086] ffff88818f000480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 980.930878][T31086] >ffff88818f000500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 980.938914][T31086] ^ [ 980.944773][T31086] ffff88818f000580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 980.952818][T31086] ffff88818f000600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 980.960861][T31086] ================================================================== 22:56:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 980.968886][T31086] Disabling lock debugging due to kernel taint [ 980.977899][ T135] usb 5-1: USB disconnect, device number 85 22:56:35 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x8004}, 0x2}], 0x1, 0x2, 0x0) 22:56:35 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x806) 22:56:35 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x9]}}, 0x1c) 22:56:35 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x0) [ 981.011847][T31120] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:35 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:35 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x1c) 22:56:35 executing program 4: mkdir(&(0x7f0000000240)='./file1\x00', 0x0) mkdir(&(0x7f00000003c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x0) mount$overlay(0x400002, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000100)='overlay\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="75707065726469723d2e2f66696c65312c6c6f7765726469723d2e2f6275732c776f726b6469723d2e2f66696c6530c3c7a66aeedbc0536f72743d6f6e2c696e6465783d6f6e9a36513836e2f5dbe53ce0f52a75614b2ed5bd23ccadeee85d71e175ccdf36f353bcc8937340bd7edd0ecb2bbb930b0ed4fcbd52231ae56f9a8b9e1a378bc19510c365fc35d737782e9ffadbe763b609209e50152ff9764e034e9c45112127b7f692901e2a89c26551c7d7cd0e0e72d31052250048629404388585ede47ddee26ba580bdcd3e35e5d4b58993d5999fd46a9536c74504c79a7d9530937e460fc46f5323688ee9bc5c19519974bed65f40f4c4e33471c4013a5b8e7a8f0c822f880ad1fa4d0fe6be328479cf1e72857daa4528af3e28"]) lgetxattr(0x0, 0x0, &(0x7f0000000400)=""/83, 0x53) open(0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$PPPIOCSCOMPRESS(r1, 0x4010744d) rmdir(&(0x7f0000000080)='./bus/file0\x00') [ 981.126596][T31137] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 981.141803][T31142] overlayfs: unrecognized mount option "index=on6Q86<*uaK.ս#̭]qu6Sȓs@~+ R#o7e57x.c P/vNNE!'*eQrR%" or missing value 22:56:36 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f00000003c0)=0x6, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000001c0)=0x2, 0x2e1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, 0x1c) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSERGETLSR(r1, 0x5459, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x54, 0x0, 0x400, 0x70bd28, 0x9, {}, [@IPVS_CMD_ATTR_SERVICE={0x10, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x29}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8000}, 0x8810) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, r3/1000+30000}, 0x10) sendto$inet6(r0, &(0x7f0000000400)="fa03711425a6b42ddc5c46757f6b420f35bb70924fa0f9cbbd6b6f4f008ce309074327bfdd3558461fe59a8fd6186e0a11a693ed5f54b054e87042b72df1ce9aa8d1c176bea1239e42ab4119d8ebba7d7572e655238e8156a75410f44a7665b186275f2182aeae9570569bea3a5a5e22475ef4d24a9fa031de3896b2b371df665a39fa4317200e1cf4457dd6a9c3a948a4d159e7c13db66c42327db092a6924604db4343b6386fd648d7e27be1cfc4ebcd71ff34048236cd59a7d4401307f3277e5ed875001a30134ed752a5b811689ab9c8060db2b73c61fa347bbe6b13411aac0c51618cd32e543960310be5", 0xfffffffffffffdf6, 0x2000400d, 0x0, 0xfffffffffffffff2) 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0xfc]}}, 0x1c) [ 981.162402][T31143] overlayfs: unrecognized mount option "index=on6Q86<*uaK.ս#̭]qu6Sȓs@~+ R#o7e57x.c P/vNNE!'*eQrR%" or missing value 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) [ 981.236343][T31151] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) 22:56:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 981.359423][T31162] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 981.445903][T31166] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:36 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x9501}, 0x2}], 0x1, 0x2, 0x0) 22:56:36 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xd00) 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) 22:56:36 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18102, 0x0) 22:56:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x3, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) [ 981.947759][T31178] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:36 executing program 4: ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000000)={0x2, 'hsr0\x00', {0x3c61}, 0xc}) syz_usb_connect(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000c250f30882050300eef70000000109022400010000000009040200090033cb0009050112"], 0x0) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r0, 0x407, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v3={0x3000000, [{0x7fff}, {0x4ea3, 0x2}], 0xee00}, 0x18, 0x2) 22:56:36 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) [ 982.050109][T31187] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:36 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x4, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) [ 982.167705][T31195] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) [ 982.246647][T31200] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x5, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 982.313507][ T135] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 982.374881][T31205] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 982.496602][T31207] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. [ 982.553446][ T135] usb 5-1: Using ep0 maxpacket: 8 22:56:37 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xe803}, 0x2}], 0x1, 0x2, 0x0) [ 982.693449][ T135] usb 5-1: config 0 has an invalid interface number: 2 but max is 0 [ 982.701491][ T135] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 982.712264][ T135] usb 5-1: config 0 has no interface number 0 [ 982.718749][ T135] usb 5-1: config 0 interface 2 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 982.728940][ T135] usb 5-1: config 0 interface 2 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 22:56:37 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xe80) 22:56:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}, 0x1c) [ 982.739216][ T135] usb 5-1: config 0 interface 2 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 982.752442][ T135] usb 5-1: New USB device found, idVendor=0582, idProduct=0003, bcdDevice=f7.ee [ 982.761779][ T135] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 982.774057][ T135] usb 5-1: config 0 descriptor?? 22:56:37 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18103, 0x0) 22:56:37 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x6, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:37 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}, 0x1c) [ 982.814855][ T135] snd-usb-audio: probe of 5-1:0.2 failed with error -12 [ 982.849356][T31224] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 982.939187][T31231] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 983.016643][ T135] usb 5-1: USB disconnect, device number 86 22:56:38 executing program 4: r0 = socket$inet6(0xa, 0x800, 0x80000001) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) socketpair$unix(0x1, 0x0, 0x0, 0x0) r1 = dup(0xffffffffffffffff) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f0000000140)={@local, @ipv4={[0x0, 0x0, 0x8], [], @empty}, @remote={0xfe, 0x80, [0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0xb]}, 0x0, 0x0, 0x0, 0x0, 0x9, 0x20c301e2, r2}) sendmmsg(r0, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x1c) 22:56:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x7, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:38 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xf401}, 0x2}], 0x1, 0x2, 0x0) 22:56:38 executing program 4: syz_read_part_table(0x0, 0x1, &(0x7f0000000280)=[{&(0x7f0000000040)="0201bfffffff0a000000ff45ac0000ffffffa900e9311b000000000000068000000063000000e100e2ff877700720030074082ffffff00000000008000da55aa", 0x40, 0x1c0}]) r0 = getpid() r1 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x401]}, 0x8, 0x80000) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f0000000180)=0x20) wait4(r0, &(0x7f0000000000), 0x8, &(0x7f0000000080)) 22:56:38 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="6664224151c0a1e258384cca9cb721da5c3cea2323181d1d396c685b42a8ab66e3be2fe79eb4c30114eac42c29c44e9ec0eb706f00dd317ce3db22bf3322c902dfa123ada5c800c71759ee7e54e14856516c362a795126f48b", @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000100172,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',allow_other,allow_other,allow_other,fscontext=sysadm_u,\x00']) ioctl$HIDIOCGRAWNAME(0xffffffffffffffff, 0x80404804, 0x0) request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f00000000c0)={'syz', 0x1, 0xd}, 0x0, 0x0) [ 983.556306][T31245] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:38 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xf00) 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}}, 0x1c) [ 983.670958][T31257] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:38 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18105, 0x0) [ 983.716500][T31264] fuse: Unknown parameter 'fd"AQX8Lʜ!\<##9lh[Bf/瞴' 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x8, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) [ 983.845713][T31274] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) [ 983.927211][T31278] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:38 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) 22:56:38 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x9, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 984.053949][T31287] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 984.165839][T31291] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:39 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0xff00}, 0x2}], 0x1, 0x2, 0x0) 22:56:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) 22:56:39 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8d, 0x400000008d}, 0x0) r0 = getpgid(0x0) sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x4}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r1, &(0x7f0000000540)=[{&(0x7f0000000340)=""/241, 0xf1}], 0x1) ioctl$TCSETS(r1, 0x5437, 0x0) [ 984.388896][T31264] fuse: Unknown parameter 'fd"AQX8Lʜ!\<##9lh[Bf/瞴' 22:56:39 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xfee) 22:56:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0xa, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 984.532404][T31307] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) 22:56:39 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18107, 0x0) 22:56:39 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xffff) rt_sigqueueinfo(0x0, 0x2a, &(0x7f0000000000)={0x23, 0xff, 0xb0}) fstatfs(r1, &(0x7f0000000200)=""/224) 22:56:39 executing program 4: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18105, 0x0) [ 984.623257][T31309] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) 22:56:39 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0xb, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:39 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}}, 0x1c) [ 984.728575][T31325] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 984.846265][T31332] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x20000}, 0x2}], 0x1, 0x2, 0x0) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}, 0x1c) 22:56:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0xc, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 985.186208][T31341] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:40 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x2800) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}}, 0x1c) [ 985.310309][T31344] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0xd, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:40 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18108, 0x0) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfc]}}, 0x1c) [ 985.454159][T31354] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:40 executing program 4: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0xfee) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}}, 0x1c) [ 985.606454][T31365] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0xe, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 985.740116][T31374] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 985.815930][T31376] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:40 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x200000}, 0x2}], 0x1, 0x2, 0x0) 22:56:40 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}}, 0x1c) 22:56:40 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 986.004143][T31382] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:41 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x3000) 22:56:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}}, 0x1c) 22:56:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x11, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 986.234638][T31396] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:41 executing program 2: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x1810d, 0x0) 22:56:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}}, 0x1c) [ 986.356476][T31399] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:41 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8, 0x0, 0x1ff}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="4800000062101de4ab6263be784c5fa778a28372c1d791cb1baa7280662a0931d3aabc97", @ANYRES16=0x0, @ANYBLOB="000000000000000000000e0000000400018030000280140001000000000000000000000000000000000006000f00fb00"], 0x48}}, 0x2804c014) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) writev(r1, &(0x7f0000001c00)=[{&(0x7f0000000480)="22264f4923ff40edb04a18bf211d06b0494ecb4c4dc9ae19720846f26a2ebeb65f758711dea4f071d9ff8da1bcb2618e91d1f43fe465ca5f38f6170a59649301afc509d82a3a3d4ef2b5034b402f77ff25fff000739b1798d618af1f15fe736744566756f813314e", 0x68}, {&(0x7f0000000740)="e63ddd4da8415c2974e1508852729bde0c52a63e835068b9ac958e53a9a533f4cdb76e13949e48b6c2552f1ba6f4e526d8cdc9dd11c0abf7f749d891542d8036b9f5b06486d24b604be5a31a8ec313360dd91491909086fd3bfdca5d8d08c48737c6a256060e05e56e9ecbbcd90ff73d7bee77c76919ec75de550852aa0d8d3eb2c5b1a2af82e03d95494ab511c04fdb5346756f0dd5e6d959a34c557960903d39d66a151a00c7bf278d759b31f6bba80cd82f6f", 0xb4}, {&(0x7f0000000240)}, {&(0x7f0000000800)="41e52bccf2c493be43868b4ea1d02f7a86bec061747023a71aecb72a1451c267d2c4042947f2203f5be9f6b3422937635a32eb97740938670b2be8d8e51be4e8c68abfec3efcb2ac2e42476ceaf8fa9c6b1f57a12a5a6e751e8af3a07f1f526bb7f401a4936702c6fbfe42bfc907dbea05a793e03c1b46deae2308d5ef0857a4ad686770919c48b22905c735e4c415148344faaf7029e21fd86e946e7000244cfa8edebbedd885ab9aff010091632fb7e1a5804d3ce65139a54479b3b3cee635b624ab5864d885d23fe3fd93933d9cd3e07c0ac31713de1c9d6ef1519351ccba14720194dc2b57d47fa0841b5122ddcd3065fbb08485bd93fa72c574fa6c0dd08e747754cfdabbfa11169addcbceda5209eed9a3e109e06ebb79f9560e305eec9aa3bd4f1452a6ab44f44c5c41deb34920f6ec5361121e606bc40c1c038b4d37a447e335af332a566ebc7536a43268ad96e0fdc8323067e06be4a2bdf4fcd79e8dddf9572ecb1720d7ac1cc495bf03b736172df7bc9ec0665afcae08c9a2311528539949e4885c7655ae4907c5ef7cf3bc463e8020b1b2462691491e9c3bbd2846d1898a645666bf6c80aff098e4e274d54c007a99f92a2ce91d506ab93df9be0b8b4bb3410a9dbf4c3ae2c26a762316505d19917e3ca64eaf51a4a88b8a87746534a98af9d1088f8124403db2df3670d4a23614cae9046c6510310a198d1fa72abe6dc038bb4b5fe90081cb5a680bd88d68836e914bc832c17a308753aa24e2a5b4fb67e294ce91106afbda93a37aa8a2ab640c2b67991c1b51c932359a82009f99567d919ae8897686c4d4dc2a19c3d3d63d9edebc0c59c591fa1a4da118aa92c2acef8cc6eeab67f632438d24765e5c4d3f6dc75273310c8fd630165826d57c3b4074eadddd1c5050b0f03201068c4813eb0d521df067a23d872f23aad7437e7b327c7dd35de0896dfd341697d729489e73b3e5d2cc854a60212f0fea4f9968d6f194e19bc0252a2cdd1a729527fe659f6c88cf88e84ce2550fd2cbc11bd17eb7cdab2ec6efd0537686886da09f0ab960e41ab3dbf0e1fd1593b03dd62b30feb25d23ec50949f6b6710c26d4845014dab0ba9a689f5f1a463b43599419ec2fc38c0e847171d0816be0ec3c5f07e055eaf77137bc1b06cff02bc8f2b605e8e1ba33f4038833b18bc9f6c1b541367b2659b4ada024e2ee2fb3bfabf41e9fba7374a2b0d799ab61d70606ec6e928f422986c668ef86c34aa25604d4174eb1111021a9d54c06efeb82559eb180fcaa147cc688ea186083d49e05d6db37c7f38abd42b499a417d745e2417742b618b576e237b4465ade4b3c8c52b2af231ee35650641f5a27ffcf2a3326625b6ee12a285b095ceae32a1021a22d834a6bda4aa5052fee850102bff3dfb2b5cd5c147b5d717bc37ed5ce00c15619d9423c32ac9e6dc42ea49711a9b5d61ad052b94204a017dff2df61d177c7ebcbcd1caff6606508c985e4db34448422b87261eabbc57ee1f16c93f24ed65cd59ba67994e4c65e43a083a71e583503191403f6e6e62d0323152b80a2a3defa028eea986a874bb9271d35b82964eae18e27c0655284cc18810bbb8bc5842cc7898a0e8c2700d0a9ad694d44823c7fd4414203ae1e5ee94b3bc6626c8bb598a1909ee8b21b291ca41e023e51f3c6f91b4cfa53149dd95420b8112ca28574dd639ef1e32c2cd7936ea30d06ad12b9b901bbff86fb816a84c92b246afbdf4f32dff3209973b0e14e81ec1f10ab88c10bd536bd2c966a7c330f3633d0c3b6e0193a17b825a7f7f998b33534939b5c1b9c196835fd2abba9b5311844ff6d01c3da0e5be83dc1416e4bab3d76f940e92dd3ca7aa9ad6445f27646cf0f9212ed69c912b973b59f1dfc78ed5a6edc1f80614beb943df43d53aee571e441e23ee4dd6654d4624f17d449a93cfe58e76a45bbedc5b0739b016cfed76083d7c7d020b8b40527b96b29f96c60fbec0d1a3ffd4764ae237a764adb3ef12694a4ea84f09d334fd46d1b06641437db056fca75f4cf77247b87609e0341a4430dd2bfee86e6b518defca657332d83d7a56ac1f44c20d6b479a5ee41ceac19bcf57975e633d5f46b57b0d39e3a428b94eac4f9a6f2bf3ab53591e21a606b05bb5874f9390c1ca599eb0d88545e6e06f051eadd84db8e25fb7b9efaebc0bd707aeae98afe699748286c1ad520399f0015a537af176cd0ee1d24ce339ca27b96a6b49a61ec7b094f85f80de4193e80a77b66bd84a3159d5d98c57f4101b39959fa592dedb1ed813291f57d80307ff03d433612f689408e933c6fb4c50869e8f9b11cf128593bbd73d9917d903b07dd53d03a19cc9314754cd6cd9a2b55e5cedb52ed48a11c8ed3943a39d9e40b2fa18d34c7184c08dd35905c53e863f1ec81275ae020f07d19c3c989b3562fcb154efadb50439ad94371c83340af6208ec0f3604e350f6978868e8504e783215529f55b72632bdf812b3ba45bd5b6ee1ed239db75b4d31856c9b60cb541e43fd437d0f23cd86d6fd0ff537e2944e22263db28ecf017e8d52f9b8f1c4fd6ecb27b3542c2387e1969db82298f427e316668abe582b3a00237e669fb0e14dbe31f47df10d72b5d535eaad76ee764324945e85719fddbf47713b832ed76550eb27390b4c4c8f2efcc939cd79aa9ad7f2a84bda35314598358ff84d2a8cff24ad760676b5843738063211771f87fe733ed1e63d8e2422dfcc3caa0cdd88064a732939525ebc25b1b968317dcabf38783e0737ba15137176b94720d6338a74cea300484b85ce15b3d79b362907897a0d4e679cc9fcaf8ea32813bb91f776effcbbc96b654cfb2211fd90f3defd170bcab4b30d4443c5ea6c00c7be9555f39eb2c851c306150e932725c32644d3bfdc52b4bc473ef7c01cf67d656dd3c51e16ef4aa55543c18a3429c372c973d06d6b7adba089c3dd01119cfdd7ca63ac8de0b4fb8140a9164342e033b7263d9154e6732fd8925f83bc55f7bf1e42075310d983cb78f2bc9c61e1b88ccc5cb9b92a53045bd6e7f67bc73778a9fb22d115a206b5ad12e1dada4ad68d374cecd93b37b1bd583a28820d6c38d199f2bd1ac6a58ffc67481066d5098ad0646f42375a764d758b84dcc2ac490553af6b45c2b06cb4b5f86e8737e75849846d4297bf797ffa2983bb6a213546db16ec20c6f3acd11ae7ad897f6a2dccd9a86fbb3830eece448a1801af3a30afd86ac31a1fc7732750e5becfe2bec1889cf2a80994e435a2577726ba4e542d7ffec41792dcea0e5d7332728fd19639c310508156a8dfac085eb64143815489d67d95205afb326c20abe3ace0f329199427445af5fa7e2df23b4c13ed6e7436cdae9011b913b19e5ca904c71d2c1f6ea779dccebc2e374f35b527a5e1b6b54b5b736045dfb605bb7e17b1cf739a3c129f5f290f47a3556a19c9f9cc13ad90330584e6b0b5b37c8a1c756fff5cb8298f80121e1784a033f93ce8a490b5dd9206a2b8d241aff2711ecfd738acc490291f3b78021cd938cf6d4b34a75e3448cc693ce08f04658fb24c689497af9a221fa57c7ee158fda7e68b9b4459c983b6fd8e40aca5d509b815b8e508b7a351540de6666191c30487ea86bb9f9efcf67a07c242ff5649d8efd87eba60fa776ef5d4124333c65f5dbbd473885ab19a0f49ce45b86638744cf8a0568c051a8facb8de4fabf86b261439e85967fb50a6ba3546fef3f0381c099b5071ccb503ade6e38382c9e4d453380df7717abf5dc11e4c13df8b9df7422c8fe35556150fcd0b35784f7f8536d31f53866316f8f3525937774d343c5cf0d9bb5fe35aceb57b1cbcb3e375e5b89dd6e344c1609f954881bc3bd5d577d12c598bf354d2b0a42d936269f3e86b459eae69ab9b61c4231f84cb1bf046a421fd4faa4e616400e1ba301f23074fba27cbf13ebae9fe25fcc1d81c3f8bee4e08d406186e8c1b97ab91e9ea9bf7191111052741128c066a944c80240046ebba010d18c748573b61980d742e61501bd76c98d198694868e3f4b5e1803b1afd5a1ff7265168a58e7ff84b0979679b1f60d5f3bc7dd76e9b062d2c2ee6f97e2816cb7545ebad1faa4dba20896906cf9bf6a841a0fdc102c933dbbdfc4b10f3719e0c6720221c44e4ad21ed92b485e6ffdc2f5dfafc2beba40c66534e5fbf4ebd04a591de51bfb71efa95d45572510b74888752fb57d9422ea6e292d990e37192060771b19881a17a7566b264911ae35fb2368d4a90cb2919fa6695e448adb56758b12544a41529b3138396a9c0edbb5f6fb369909514582b5dccf557d042289c267add8f7db8d76f6e15498a019bbf9dfc558d743a11ab64b038616f7bf13ebfeb52b0f7985fd2534f0758dcb9333bcefdd6da35d824939be2cfdc4630979e409aebc21893d4c1ed00838ee80135b799dea31d9f0cdd03f9d8398bf206f7a847c535efbbc236bc7742b97e703ccd6fdfc9e9c00d306258bf393aa09a813b49cee2407121897c7b73c3bb3ab3c06d542737ed5a23049594afa647312760fa3e5d28507c469b42b7e0ce8c031c2caf6b47282ac9dbc6ab27b26f9150199c61450bbc9490ee4bc995f72254d9865d13bd6666693f8fa91a0c50c836850e8870968146f4631d2de6114e19b761cb5c981d4aae2bd078db173c12a665dcde111e11e7ac609d14e0787f26e0d8e9b20bc3c81e44c441c0c43f2976f4b696f5c5d771277f18bf19779ee45c18edcbc3d96fe9a9f57a011aa333c196865e9c13e8b979efe0eb1684743998948d9d0ffb7947d7586866dd00d37dd2f7d9d26b9b178d1405a2b2b925fd98f89b957a23769e0e10b968ca5d30ce4e4d170b9f49927083b929e0c6f2875597adca5736bedefbe147112b8b12199ac1d55f6879accafeeb5abe473f13ab9bba2404a7e150aa9f0c19af232c0cfa1df9ddce0deabaea059ad77202ad70a578d645757c802ac9106bfd4ba3fe459eaf4e92d9d2e041149750855b62dd89519bfe0ea982b5d939846f6072b094ff6f49199a2da47d05c18aab4521f04ffa2238822626b87acb5f2f2c929a6eff5be4fe32a7260983b27aa58d55de15c685ea5275b99eeda71b3810a927236dfc634fe490a8dec2bec214719ed7325b2acea53fdce6d52a2cf86cf19408d9a35a8bbb98dc64f66182f4d04da1e40dc345e64ac9aadd310d235c6d26d72b105b2026f337a8fda8c406e99f67ccbdfc1c19c1f590a0a18c2e647c02c5bc42a6f0bafccaabe923808a238cff669a21e20cfda3b5ee5cbee5e2e761adf0a675396154ce20889fa3fc4e23e367a24753ded512d7cf20ca7120878c5ae7b7657a915bc2aaa117d1858eb01d2abbf45a2aef8c252fcf0b2ac256950d941181fb87cd48ccf09df720adb4f0c3dd3a33b2bc98d32cdb8ab2010a58a9b7892270e5e26d5cba1bc0cd504495c8189467c074284f2f0feda7be9439c97ae30a1f9e62e3cc3755462f045ed671c562a5a3b8b73a7e27c1098135f5eeb286247a2eac9ed9856e2b93a9cc6bff8d4b06fb197b138ba53a306f7c2417f345cf5b35009405b028d21516ba89e321d1e7a4292244980e9a391a49ae821bf516969fcab30f4176b3761d347529523727daca8864bc4f9c3392074f7104347db12d8a2ef6474de29a58d9fe7723b14488b85e82893b04ac17ec1a7acbb9712b497661aa7165b300bca93243a61d6de18ccfd11edb6b608f5b684e49f048b59bdcc57efc16ad4b7b566aae3eba90e08a2ad041c892fcdca9cefc5c788c481b355596517e7c464d51efb4d", 0x1000}, {&(0x7f0000001800)="49fcf183364a18ecd4857f50acd5f949712d5b115f2d1a4d3cdcfdc4d749e8cf6416e0ca9cbf7916023be5699c0b6d22d030869279eac3a131939eb03172052aac023833f9bf604c9f1b0c9c5585ddc3be292a80806562a361dadfaa496256daedb3e0cc971c5da8df9d3d5ff580f793033820f8902ec39db7bcb6c969c6a2e3f2afac7c558a44c41e683c1de44c2744210276154d3278a0", 0x98}, {&(0x7f00000018c0)="f8e1db2d84d692aef34126a6c982b4bb5e04f14c82200f251bc14bba95056250748131da264b729ff405ff1024e13bf1cd67b37d446cefa1ff13bd3e487be0770166518f5e96c462600426e62b0cf3d78440e542d174fc66d1231efc94972060b13ca7cf12bfc17838989b920b39a2c36f29caf47b3f5c056949e5c58f437e9b3b7b57e77662ca185de40aec60efead5c016d3", 0xf0}, {&(0x7f0000001980)="898031a4ddd898ce7f0f7239a5eae02cab8092d04d8dffcdfa20d17ee91d253a528dd3ab8be66eabc6f0d83e1191b2c70785ac09c7e16ae6e6cdcfa823dd3f1e894a8efd381644d71b61b2b357703c806b547623eb694e105e9e32da01d90242ded80ec4f7750db2b6be1fd71ee8ed0319d62684ffca29d846a536", 0x7b}, {&(0x7f0000001a00)="6f040beea3a79230e6258541ddb06f9aeab43e2e9f5d53700415ef05e2191b19fce69cdc08f1b030043b4d7353a0ae061268de6c4da89a0903413f1998755d61d2a672d63b02f48b5a093698652428587ee6bd87ebb94cb2acdf599e2258e96267247458de5240b1ee3b446c5794642ccb5a5828027b379c7b9739341f1f1b5b72d020966f4da674c017a5517fa3027d48a31e37844e2d0da5636b6ed539", 0x9e}, {&(0x7f0000001ac0)="948105e5aab711f2d5ebf66ed2ed8267212bd6c31dc477baf42a169dad375b03e02319e4d924141d47e3aaa41991f34256fe53e64e764f187fbd85fdbd217a416d06fece61e68c9ae1af0fd0a5df2c86047a11d1ce24441429bf5314a4b5e2a7162e9a578be7a32b04b7f1ef", 0x74}, {&(0x7f0000001cc0)="8b22e4d886c000000f8462e41a97a7029d22d437bece21f027c1ccb86ea8bcff0cac9218319235754eb6405fe477c32ccc15def3ba7f203a9455d538fb73a3e2386554661861a8be0e0fc5949c5670aa798d0bd9481b74e7b80e30ce20543310addac3685dde626593292d11d30a12a898bafc573cc0ba80175c0f3b9a70af79f23733819b9633d181b3ef2a9165e6d3f1440aef5ba34ac1a5c6c41cab7c09d42a2d0cba9e813cc34a94885b1f39c769c2c327c6260f1e978f2fbfa3a802a6eded99ce1beee5599502808e57455eebf46daf85ae5007bac30466d8914ebd5cb493f0da1a9791253667a9af9cdaa31f6d528911d1879a127795d1156d72d5bed649122be514988ecee48309774b5aaa3770018660ff937081bd41eb84a1dd4327052b97437689b5f641ec0478b94a4a13dbfb0c38d41213e64454f80daa928fe39351a2440cf15b5eb7bbab369ca879f7a71412e74c544eb9be64b9afccf5a8a73b6d30f64ab6cb5a0e0e67a1e19d80b282102411cda464869ca9599c47c4f49bd08c035b7e25d2cc7289066469810e9e4bdd0ed344862de0ba458b70537b3c2a2691ae556c82d36e881af1b744c8813948", 0xb3}], 0xa) execve(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000700)=[&(0x7f0000000400)='/dev/fuse\x00', &(0x7f0000000580)=')\\\xf9\x99{-.,\xb3-^!&$\x00', &(0x7f00000005c0)='/dev/fuse\x00', &(0x7f0000000600)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f0000000640)='fd']) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000340)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x807a}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) 22:56:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x12, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) 22:56:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}}, 0x1c) [ 986.526059][T31413] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready 22:56:41 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8, 0x0, 0x1ff}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="4800000062101de4ab6263be784c5fa778a28372c1d791cb1baa7280662a0931d3aabc97", @ANYRES16=0x0, @ANYBLOB="000000000000000000000e0000000400018030000280140001000000000000000000000000000000000006000f00fb00"], 0x48}}, 0x2804c014) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) writev(r1, &(0x7f0000001c00)=[{&(0x7f0000000480)="22264f4923ff40edb04a18bf211d06b0494ecb4c4dc9ae19720846f26a2ebeb65f758711dea4f071d9ff8da1bcb2618e91d1f43fe465ca5f38f6170a59649301afc509d82a3a3d4ef2b5034b402f77ff25fff000739b1798d618af1f15fe736744566756f813314e", 0x68}, {&(0x7f0000000740)="e63ddd4da8415c2974e1508852729bde0c52a63e835068b9ac958e53a9a533f4cdb76e13949e48b6c2552f1ba6f4e526d8cdc9dd11c0abf7f749d891542d8036b9f5b06486d24b604be5a31a8ec313360dd91491909086fd3bfdca5d8d08c48737c6a256060e05e56e9ecbbcd90ff73d7bee77c76919ec75de550852aa0d8d3eb2c5b1a2af82e03d95494ab511c04fdb5346756f0dd5e6d959a34c557960903d39d66a151a00c7bf278d759b31f6bba80cd82f6f", 0xb4}, {&(0x7f0000000240)}, {&(0x7f0000000800)="41e52bccf2c493be43868b4ea1d02f7a86bec061747023a71aecb72a1451c267d2c4042947f2203f5be9f6b3422937635a32eb97740938670b2be8d8e51be4e8c68abfec3efcb2ac2e42476ceaf8fa9c6b1f57a12a5a6e751e8af3a07f1f526bb7f401a4936702c6fbfe42bfc907dbea05a793e03c1b46deae2308d5ef0857a4ad686770919c48b22905c735e4c415148344faaf7029e21fd86e946e7000244cfa8edebbedd885ab9aff010091632fb7e1a5804d3ce65139a54479b3b3cee635b624ab5864d885d23fe3fd93933d9cd3e07c0ac31713de1c9d6ef1519351ccba14720194dc2b57d47fa0841b5122ddcd3065fbb08485bd93fa72c574fa6c0dd08e747754cfdabbfa11169addcbceda5209eed9a3e109e06ebb79f9560e305eec9aa3bd4f1452a6ab44f44c5c41deb34920f6ec5361121e606bc40c1c038b4d37a447e335af332a566ebc7536a43268ad96e0fdc8323067e06be4a2bdf4fcd79e8dddf9572ecb1720d7ac1cc495bf03b736172df7bc9ec0665afcae08c9a2311528539949e4885c7655ae4907c5ef7cf3bc463e8020b1b2462691491e9c3bbd2846d1898a645666bf6c80aff098e4e274d54c007a99f92a2ce91d506ab93df9be0b8b4bb3410a9dbf4c3ae2c26a762316505d19917e3ca64eaf51a4a88b8a87746534a98af9d1088f8124403db2df3670d4a23614cae9046c6510310a198d1fa72abe6dc038bb4b5fe90081cb5a680bd88d68836e914bc832c17a308753aa24e2a5b4fb67e294ce91106afbda93a37aa8a2ab640c2b67991c1b51c932359a82009f99567d919ae8897686c4d4dc2a19c3d3d63d9edebc0c59c591fa1a4da118aa92c2acef8cc6eeab67f632438d24765e5c4d3f6dc75273310c8fd630165826d57c3b4074eadddd1c5050b0f03201068c4813eb0d521df067a23d872f23aad7437e7b327c7dd35de0896dfd341697d729489e73b3e5d2cc854a60212f0fea4f9968d6f194e19bc0252a2cdd1a729527fe659f6c88cf88e84ce2550fd2cbc11bd17eb7cdab2ec6efd0537686886da09f0ab960e41ab3dbf0e1fd1593b03dd62b30feb25d23ec50949f6b6710c26d4845014dab0ba9a689f5f1a463b43599419ec2fc38c0e847171d0816be0ec3c5f07e055eaf77137bc1b06cff02bc8f2b605e8e1ba33f4038833b18bc9f6c1b541367b2659b4ada024e2ee2fb3bfabf41e9fba7374a2b0d799ab61d70606ec6e928f422986c668ef86c34aa25604d4174eb1111021a9d54c06efeb82559eb180fcaa147cc688ea186083d49e05d6db37c7f38abd42b499a417d745e2417742b618b576e237b4465ade4b3c8c52b2af231ee35650641f5a27ffcf2a3326625b6ee12a285b095ceae32a1021a22d834a6bda4aa5052fee850102bff3dfb2b5cd5c147b5d717bc37ed5ce00c15619d9423c32ac9e6dc42ea49711a9b5d61ad052b94204a017dff2df61d177c7ebcbcd1caff6606508c985e4db34448422b87261eabbc57ee1f16c93f24ed65cd59ba67994e4c65e43a083a71e583503191403f6e6e62d0323152b80a2a3defa028eea986a874bb9271d35b82964eae18e27c0655284cc18810bbb8bc5842cc7898a0e8c2700d0a9ad694d44823c7fd4414203ae1e5ee94b3bc6626c8bb598a1909ee8b21b291ca41e023e51f3c6f91b4cfa53149dd95420b8112ca28574dd639ef1e32c2cd7936ea30d06ad12b9b901bbff86fb816a84c92b246afbdf4f32dff3209973b0e14e81ec1f10ab88c10bd536bd2c966a7c330f3633d0c3b6e0193a17b825a7f7f998b33534939b5c1b9c196835fd2abba9b5311844ff6d01c3da0e5be83dc1416e4bab3d76f940e92dd3ca7aa9ad6445f27646cf0f9212ed69c912b973b59f1dfc78ed5a6edc1f80614beb943df43d53aee571e441e23ee4dd6654d4624f17d449a93cfe58e76a45bbedc5b0739b016cfed76083d7c7d020b8b40527b96b29f96c60fbec0d1a3ffd4764ae237a764adb3ef12694a4ea84f09d334fd46d1b06641437db056fca75f4cf77247b87609e0341a4430dd2bfee86e6b518defca657332d83d7a56ac1f44c20d6b479a5ee41ceac19bcf57975e633d5f46b57b0d39e3a428b94eac4f9a6f2bf3ab53591e21a606b05bb5874f9390c1ca599eb0d88545e6e06f051eadd84db8e25fb7b9efaebc0bd707aeae98afe699748286c1ad520399f0015a537af176cd0ee1d24ce339ca27b96a6b49a61ec7b094f85f80de4193e80a77b66bd84a3159d5d98c57f4101b39959fa592dedb1ed813291f57d80307ff03d433612f689408e933c6fb4c50869e8f9b11cf128593bbd73d9917d903b07dd53d03a19cc9314754cd6cd9a2b55e5cedb52ed48a11c8ed3943a39d9e40b2fa18d34c7184c08dd35905c53e863f1ec81275ae020f07d19c3c989b3562fcb154efadb50439ad94371c83340af6208ec0f3604e350f6978868e8504e783215529f55b72632bdf812b3ba45bd5b6ee1ed239db75b4d31856c9b60cb541e43fd437d0f23cd86d6fd0ff537e2944e22263db28ecf017e8d52f9b8f1c4fd6ecb27b3542c2387e1969db82298f427e316668abe582b3a00237e669fb0e14dbe31f47df10d72b5d535eaad76ee764324945e85719fddbf47713b832ed76550eb27390b4c4c8f2efcc939cd79aa9ad7f2a84bda35314598358ff84d2a8cff24ad760676b5843738063211771f87fe733ed1e63d8e2422dfcc3caa0cdd88064a732939525ebc25b1b968317dcabf38783e0737ba15137176b94720d6338a74cea300484b85ce15b3d79b362907897a0d4e679cc9fcaf8ea32813bb91f776effcbbc96b654cfb2211fd90f3defd170bcab4b30d4443c5ea6c00c7be9555f39eb2c851c306150e932725c32644d3bfdc52b4bc473ef7c01cf67d656dd3c51e16ef4aa55543c18a3429c372c973d06d6b7adba089c3dd01119cfdd7ca63ac8de0b4fb8140a9164342e033b7263d9154e6732fd8925f83bc55f7bf1e42075310d983cb78f2bc9c61e1b88ccc5cb9b92a53045bd6e7f67bc73778a9fb22d115a206b5ad12e1dada4ad68d374cecd93b37b1bd583a28820d6c38d199f2bd1ac6a58ffc67481066d5098ad0646f42375a764d758b84dcc2ac490553af6b45c2b06cb4b5f86e8737e75849846d4297bf797ffa2983bb6a213546db16ec20c6f3acd11ae7ad897f6a2dccd9a86fbb3830eece448a1801af3a30afd86ac31a1fc7732750e5becfe2bec1889cf2a80994e435a2577726ba4e542d7ffec41792dcea0e5d7332728fd19639c310508156a8dfac085eb64143815489d67d95205afb326c20abe3ace0f329199427445af5fa7e2df23b4c13ed6e7436cdae9011b913b19e5ca904c71d2c1f6ea779dccebc2e374f35b527a5e1b6b54b5b736045dfb605bb7e17b1cf739a3c129f5f290f47a3556a19c9f9cc13ad90330584e6b0b5b37c8a1c756fff5cb8298f80121e1784a033f93ce8a490b5dd9206a2b8d241aff2711ecfd738acc490291f3b78021cd938cf6d4b34a75e3448cc693ce08f04658fb24c689497af9a221fa57c7ee158fda7e68b9b4459c983b6fd8e40aca5d509b815b8e508b7a351540de6666191c30487ea86bb9f9efcf67a07c242ff5649d8efd87eba60fa776ef5d4124333c65f5dbbd473885ab19a0f49ce45b86638744cf8a0568c051a8facb8de4fabf86b261439e85967fb50a6ba3546fef3f0381c099b5071ccb503ade6e38382c9e4d453380df7717abf5dc11e4c13df8b9df7422c8fe35556150fcd0b35784f7f8536d31f53866316f8f3525937774d343c5cf0d9bb5fe35aceb57b1cbcb3e375e5b89dd6e344c1609f954881bc3bd5d577d12c598bf354d2b0a42d936269f3e86b459eae69ab9b61c4231f84cb1bf046a421fd4faa4e616400e1ba301f23074fba27cbf13ebae9fe25fcc1d81c3f8bee4e08d406186e8c1b97ab91e9ea9bf7191111052741128c066a944c80240046ebba010d18c748573b61980d742e61501bd76c98d198694868e3f4b5e1803b1afd5a1ff7265168a58e7ff84b0979679b1f60d5f3bc7dd76e9b062d2c2ee6f97e2816cb7545ebad1faa4dba20896906cf9bf6a841a0fdc102c933dbbdfc4b10f3719e0c6720221c44e4ad21ed92b485e6ffdc2f5dfafc2beba40c66534e5fbf4ebd04a591de51bfb71efa95d45572510b74888752fb57d9422ea6e292d990e37192060771b19881a17a7566b264911ae35fb2368d4a90cb2919fa6695e448adb56758b12544a41529b3138396a9c0edbb5f6fb369909514582b5dccf557d042289c267add8f7db8d76f6e15498a019bbf9dfc558d743a11ab64b038616f7bf13ebfeb52b0f7985fd2534f0758dcb9333bcefdd6da35d824939be2cfdc4630979e409aebc21893d4c1ed00838ee80135b799dea31d9f0cdd03f9d8398bf206f7a847c535efbbc236bc7742b97e703ccd6fdfc9e9c00d306258bf393aa09a813b49cee2407121897c7b73c3bb3ab3c06d542737ed5a23049594afa647312760fa3e5d28507c469b42b7e0ce8c031c2caf6b47282ac9dbc6ab27b26f9150199c61450bbc9490ee4bc995f72254d9865d13bd6666693f8fa91a0c50c836850e8870968146f4631d2de6114e19b761cb5c981d4aae2bd078db173c12a665dcde111e11e7ac609d14e0787f26e0d8e9b20bc3c81e44c441c0c43f2976f4b696f5c5d771277f18bf19779ee45c18edcbc3d96fe9a9f57a011aa333c196865e9c13e8b979efe0eb1684743998948d9d0ffb7947d7586866dd00d37dd2f7d9d26b9b178d1405a2b2b925fd98f89b957a23769e0e10b968ca5d30ce4e4d170b9f49927083b929e0c6f2875597adca5736bedefbe147112b8b12199ac1d55f6879accafeeb5abe473f13ab9bba2404a7e150aa9f0c19af232c0cfa1df9ddce0deabaea059ad77202ad70a578d645757c802ac9106bfd4ba3fe459eaf4e92d9d2e041149750855b62dd89519bfe0ea982b5d939846f6072b094ff6f49199a2da47d05c18aab4521f04ffa2238822626b87acb5f2f2c929a6eff5be4fe32a7260983b27aa58d55de15c685ea5275b99eeda71b3810a927236dfc634fe490a8dec2bec214719ed7325b2acea53fdce6d52a2cf86cf19408d9a35a8bbb98dc64f66182f4d04da1e40dc345e64ac9aadd310d235c6d26d72b105b2026f337a8fda8c406e99f67ccbdfc1c19c1f590a0a18c2e647c02c5bc42a6f0bafccaabe923808a238cff669a21e20cfda3b5ee5cbee5e2e761adf0a675396154ce20889fa3fc4e23e367a24753ded512d7cf20ca7120878c5ae7b7657a915bc2aaa117d1858eb01d2abbf45a2aef8c252fcf0b2ac256950d941181fb87cd48ccf09df720adb4f0c3dd3a33b2bc98d32cdb8ab2010a58a9b7892270e5e26d5cba1bc0cd504495c8189467c074284f2f0feda7be9439c97ae30a1f9e62e3cc3755462f045ed671c562a5a3b8b73a7e27c1098135f5eeb286247a2eac9ed9856e2b93a9cc6bff8d4b06fb197b138ba53a306f7c2417f345cf5b35009405b028d21516ba89e321d1e7a4292244980e9a391a49ae821bf516969fcab30f4176b3761d347529523727daca8864bc4f9c3392074f7104347db12d8a2ef6474de29a58d9fe7723b14488b85e82893b04ac17ec1a7acbb9712b497661aa7165b300bca93243a61d6de18ccfd11edb6b608f5b684e49f048b59bdcc57efc16ad4b7b566aae3eba90e08a2ad041c892fcdca9cefc5c788c481b355596517e7c464d51efb4d", 0x1000}, {&(0x7f0000001800)="49fcf183364a18ecd4857f50acd5f949712d5b115f2d1a4d3cdcfdc4d749e8cf6416e0ca9cbf7916023be5699c0b6d22d030869279eac3a131939eb03172052aac023833f9bf604c9f1b0c9c5585ddc3be292a80806562a361dadfaa496256daedb3e0cc971c5da8df9d3d5ff580f793033820f8902ec39db7bcb6c969c6a2e3f2afac7c558a44c41e683c1de44c2744210276154d3278a0", 0x98}, {&(0x7f00000018c0)="f8e1db2d84d692aef34126a6c982b4bb5e04f14c82200f251bc14bba95056250748131da264b729ff405ff1024e13bf1cd67b37d446cefa1ff13bd3e487be0770166518f5e96c462600426e62b0cf3d78440e542d174fc66d1231efc94972060b13ca7cf12bfc17838989b920b39a2c36f29caf47b3f5c056949e5c58f437e9b3b7b57e77662ca185de40aec60efead5c016d3", 0xf0}, {&(0x7f0000001980)="898031a4ddd898ce7f0f7239a5eae02cab8092d04d8dffcdfa20d17ee91d253a528dd3ab8be66eabc6f0d83e1191b2c70785ac09c7e16ae6e6cdcfa823dd3f1e894a8efd381644d71b61b2b357703c806b547623eb694e105e9e32da01d90242ded80ec4f7750db2b6be1fd71ee8ed0319d62684ffca29d846a536", 0x7b}, {&(0x7f0000001a00)="6f040beea3a79230e6258541ddb06f9aeab43e2e9f5d53700415ef05e2191b19fce69cdc08f1b030043b4d7353a0ae061268de6c4da89a0903413f1998755d61d2a672d63b02f48b5a093698652428587ee6bd87ebb94cb2acdf599e2258e96267247458de5240b1ee3b446c5794642ccb5a5828027b379c7b9739341f1f1b5b72d020966f4da674c017a5517fa3027d48a31e37844e2d0da5636b6ed539", 0x9e}, {&(0x7f0000001ac0)="948105e5aab711f2d5ebf66ed2ed8267212bd6c31dc477baf42a169dad375b03e02319e4d924141d47e3aaa41991f34256fe53e64e764f187fbd85fdbd217a416d06fece61e68c9ae1af0fd0a5df2c86047a11d1ce24441429bf5314a4b5e2a7162e9a578be7a32b04b7f1ef", 0x74}, {&(0x7f0000001cc0)="8b22e4d886c000000f8462e41a97a7029d22d437bece21f027c1ccb86ea8bcff0cac9218319235754eb6405fe477c32ccc15def3ba7f203a9455d538fb73a3e2386554661861a8be0e0fc5949c5670aa798d0bd9481b74e7b80e30ce20543310addac3685dde626593292d11d30a12a898bafc573cc0ba80175c0f3b9a70af79f23733819b9633d181b3ef2a9165e6d3f1440aef5ba34ac1a5c6c41cab7c09d42a2d0cba9e813cc34a94885b1f39c769c2c327c6260f1e978f2fbfa3a802a6eded99ce1beee5599502808e57455eebf46daf85ae5007bac30466d8914ebd5cb493f0da1a9791253667a9af9cdaa31f6d528911d1879a127795d1156d72d5bed649122be514988ecee48309774b5aaa3770018660ff937081bd41eb84a1dd4327052b97437689b5f641ec0478b94a4a13dbfb0c38d41213e64454f80daa928fe39351a2440cf15b5eb7bbab369ca879f7a71412e74c544eb9be64b9afccf5a8a73b6d30f64ab6cb5a0e0e67a1e19d80b282102411cda464869ca9599c47c4f49bd08c035b7e25d2cc7289066469810e9e4bdd0ed344862de0ba458b70537b3c2a2691ae556c82d36e881af1b744c8813948", 0xb3}], 0xa) execve(&(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000700)=[&(0x7f0000000400)='/dev/fuse\x00', &(0x7f0000000580)=')\\\xf9\x99{-.,\xb3-^!&$\x00', &(0x7f00000005c0)='/dev/fuse\x00', &(0x7f0000000600)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f0000000640)='fd']) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x0, &(0x7f0000000340)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x807a}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000080)='/proc/thread-self/attr/fscreate\x00', 0x2, 0x0) [ 986.628597][T31420] net_ratelimit: 1 callbacks suppressed [ 986.628603][T31420] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000000)=0xbf, 0x4) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r0, &(0x7f00000000c0)="044aac2f202c5feda71e039a57a93088fdcce4afe28aac61837792741a190670ccbe1a2b00aa77a87d56a3f12c7920ad02928a5d1014e5b896f000fcf6521928480be9af82613a5c661f4110adba358afd8b5b4ef1702051e393ede2698112a1f1bdf1d0f568546ed322ab4c53545bd2cd6e48522f0c154cb3c6864dc30ae921db100f1ee97a234503338f8fdf356472da0c7ab62f274f34", 0xfffffffffffffee0, 0x20000004, &(0x7f0000b63fe4)={0xa, 0x2}, 0x1c) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000840)=""/4085, 0xff5}], 0x1, 0x0, 0x0, 0x20c49b}, 0x2}], 0x1, 0x2, 0x0) 22:56:41 executing program 3: r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket(0x11, 0x800000003, 0x0) bind(r1, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000100)=0x46) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000000)={@remote, r2}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = dup(r3) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}}, 0x1c) 22:56:41 executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f00000000c0)=r4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'\x00', 0x7132}) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000040)={'lo\x00', 0x400}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2c}]}, &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f000062b000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="340000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r6, @ANYBLOB="08001b"], 0x34}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x48, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="2000000011000d1200"/20, @ANYRES32=r9], 0x20}}, 0x0) [ 986.833047][T31432] IPv6: ADDRCONF(NETDEV_CHANGE): vti0: link becomes ready [ 986.925853][T31438] A link change request failed with some changes committed already. Interface Y4`Ҙ may have been left with an inconsistent configuration, please check. 22:56:41 executing program 0: pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x88882, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000100)={'syzkaller1\x00', 0xa732}) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r4, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', {0x7, 0x0, @multicast2}}) write$tun(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000180c2000000aaaaaaaaaa0086dd60a56938006411"], 0x9e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) write$binfmt_misc(r1, &(0x7f0000000140)=ANY=[], 0x1000000c8) splice(r0, 0x0, r2, 0x0, 0x18100, 0x3580) 22:56:41 executing program 4: prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x9, 0x400000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000280)={0x38, 0x2, 0x0, 0x0, 0x8, 0x0, 0x1ff}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000001f40)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000440)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=ANY=[@ANYBLOB="4800000062101de4ab6263be784c5fa778a28372c1d791cb1baa7280662a0931d3aabc97", @ANYRES16=0x0, @ANYBLOB="000000000000000000000e0000000400018030000280140001000000000000000000000000000000000006000f00fb00"], 0x48}}, 0x2804c014) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x36a) writev(r1, &(0x7f0000001c00)=[{&(0x7f0000000480)="22264f4923ff40edb04a18bf211d06b0494ecb4c4dc9ae19720846f26a2ebeb65f758711dea4f071d9ff8da1bcb2618e91d1f43fe465ca5f38f6170a59649301afc509d82a3a3d4ef2b5034b402f77ff25fff000739b1798d618af1f15fe736744566756f813314e", 0x68}, {&(0x7f0000000740)="e63ddd4da8415c2974e1508852729bde0c52a63e835068b9ac958e53a9a533f4cdb76e13949e48b6c2552f1ba6f4e526d8cdc9dd11c0abf7f749d891542d8036b9f5b06486d24b604be5a31a8ec313360dd91491909086fd3bfdca5d8d08c48737c6a256060e05e56e9ecbbcd90ff73d7bee77c76919ec75de550852aa0d8d3eb2c5b1a2af82e03d95494ab511c04fdb5346756f0dd5e6d959a34c557960903d39d66a151a00c7bf278d759b31f6bba80cd82f6f", 0xb4}, {&(0x7f0000000240)}, {&(0x7f0000000800)="41e52bccf2c493be43868b4ea1d02f7a86bec061747023a71aecb72a1451c267d2c4042947f2203f5be9f6b3422937635a32eb97740938670b2be8d8e51be4e8c68abfec3efcb2ac2e42476ceaf8fa9c6b1f57a12a5a6e751e8af3a07f1f526bb7f401a4936702c6fbfe42bfc907dbea05a793e03c1b46deae2308d5ef0857a4ad686770919c48b22905c735e4c415148344faaf7029e21fd86e946e7000244cfa8edebbedd885ab9aff010091632fb7e1a5804d3ce65139a54479b3b3cee635b624ab5864d885d23fe3fd93933d9cd3e07c0ac31713de1c9d6ef1519351ccba14720194dc2b57d47fa0841b5122ddcd3065fbb08485bd93fa72c574fa6c0dd08e747754cfdabbfa11169addcbceda5209eed9a3e109e06ebb79f9560e305eec9aa3bd4f1452a6ab44f44c5c41deb34920f6ec5361121e606bc40c1c038b4d37a447e335af332a566ebc7536a43268ad96e0fdc8323067e06be4a2bdf4fcd79e8dddf9572ecb1720d7ac1cc495bf03b736172df7bc9ec0665afcae08c9a2311528539949e4885c7655ae4907c5ef7cf3bc463e8020b1b2462691491e9c3bbd2846d1898a645666bf6c80aff098e4e274d54c007a99f92a2ce91d506ab93df9be0b8b4bb3410a9dbf4c3ae2c26a762316505d19917e3ca64eaf51a4a88b8a87746534a98af9d1088f8124403db2df3670d4a23614cae9046c6510310a198d1fa72abe6dc038bb4b5fe90081cb5a680bd88d68836e914bc832c17a308753aa24e2a5b4fb67e294ce91106afbda93a37aa8a2ab640c2b67991c1b51c932359a82009f99567d919ae8897686c4d4dc2a19c3d3d63d9edebc0c59c591fa1a4da118aa92c2acef8cc6eeab67f632438d24765e5c4d3f6dc75273310c8fd630165826d57c3b4074eadddd1c5050b0f03201068c4813eb0d521df067a23d872f23aad7437e7b327c7dd35de0896dfd341697d729489e73b3e5d2cc854a60212f0fea4f9968d6f194e19bc0252a2cdd1a729527fe659f6c88cf88e84ce2550fd2cbc11bd17eb7cdab2ec6efd0537686886da09f0ab960e41ab3dbf0e1fd1593b03dd62b30feb25d23ec50949f6b6710c26d4845014dab0ba9a689f5f1a463b43599419ec2fc38c0e847171d0816be0ec3c5f07e055eaf77137bc1b06cff02bc8f2b605e8e1ba33f4038833b18bc9f6c1b541367b2659b4ada024e2ee2fb3bfabf41e9fba7374a2b0d799ab61d70606ec6e928f422986c668ef86c34aa25604d4174eb1111021a9d54c06efeb82559eb180fcaa147cc688ea186083d49e05d6db37c7f38abd42b499a417d745e2417742b618b576e237b4465ade4b3c8c52b2af231ee35650641f5a27ffcf2a3326625b6ee12a285b095ceae32a1021a22d834a6bda4aa5052fee850102bff3dfb2b5cd5c147b5d717bc37ed5ce00c15619d9423c32ac9e6dc42ea49711a9b5d61ad052b94204a017dff2df61d177c7ebcbcd1caff6606508c985e4db34448422b87261eabbc57ee1f16c93f24ed65cd59ba67994e4c65e43a083a71e583503191403f6e6e62d0323152b80a2a3defa028eea986a874bb9271d35b82964eae18e27c0655284cc18810bbb8bc5842cc7898a0e8c2700d0a9ad694d44823c7fd4414203ae1e5ee94b3bc6626c8bb598a1909ee8b21b291ca41e023e51f3c6f91b4cfa53149dd95420b8112ca28574dd639ef1e32c2cd7936ea30d06ad12b9b901bbff86fb816a84c92b246afbdf4f32dff3209973b0e14e81ec1f10ab88c10bd536bd2c966a7c330f3633d0c3b6e0193a17b825a7f7f998b33534939b5c1b9c196835fd2abba9b5311844ff6d01c3da0e5be83dc1416e4bab3d76f940e92dd3ca7aa9ad6445f27646cf0f9212ed69c912b973b59f1dfc78ed5a6edc1f80614beb943df43d53aee571e441e23ee4dd6654d4624f17d449a93cfe58e76a45bbedc5b0739b016cfed76083d7c7d020b8b40527b96b29f96c60fbec0d1a3ffd4764ae237a764adb3ef12694a4ea84f09d334fd46d1b06641437db056fca75f4cf77247b87609e0341a4430dd2bfee86e6b518defca657332d83d7a56ac1f44c20d6b479a5ee41ceac19bcf57975e633d5f46b57b0d39e3a428b94eac4f9a6f2bf3ab53591e21a606b05bb5874f9390c1ca599eb0d88545e6e06f051eadd84db8e25fb7b9efaebc0bd707aeae98afe699748286c1ad520399f0015a537af176cd0ee1d24ce339ca27b96a6b49a61ec7b094f85f80de4193e80a77b66bd84a3159d5d98c57f4101b39959fa592dedb1ed813291f57d80307ff03d433612f689408e933c6fb4c50869e8f9b11cf128593bbd73d9917d903b07dd53d03a19cc9314754cd6cd9a2b55e5cedb52ed48a11c8ed3943a39d9e40b2fa18d34c7184c08dd35905c53e863f1ec81275ae020f07d19c3c989b3562fcb154efadb50439ad94371c83340af6208ec0f3604e350f6978868e8504e783215529f55b72632bdf812b3ba45bd5b6ee1ed239db75b4d31856c9b60cb541e43fd437d0f23cd86d6fd0ff537e2944e22263db28ecf017e8d52f9b8f1c4fd6ecb27b3542c2387e1969db82298f427e316668abe582b3a00237e669fb0e14dbe31f47df10d72b5d535eaad76ee764324945e85719fddbf47713b832ed76550eb27390b4c4c8f2efcc939cd79aa9ad7f2a84bda35314598358ff84d2a8cff24ad760676b5843738063211771f87fe733ed1e63d8e2422dfcc3caa0cdd88064a732939525ebc25b1b968317dcabf38783e0737ba15137176b94720d6338a74cea300484b85ce15b3d79b362907897a0d4e679cc9fcaf8ea32813bb91f776effcbbc96b654cfb2211fd90f3defd170bcab4b30d4443c5ea6c00c7be9555f39eb2c851c306150e932725c32644d3bfdc52b4bc473ef7c01cf67d656dd3c51e16ef4aa55543c18a3429c372c973d06d6b7adba089c3dd01119cfdd7ca63ac8de0b4fb8140a9164342e033b7263d9154e6732fd8925f83bc55f7bf1e42075310d983cb78f2bc9c61e1b88ccc5cb9b92a53045bd6e7f67bc73778a9fb22d115a206b5ad12e1dada4ad68d374cecd93b37b1bd583a28820d6c38d199f2bd1ac6a58ffc67481066d5098ad0646f42375a764d758b84dcc2ac490553af6b45c2b06cb4b5f86e8737e75849846d4297bf797ffa2983bb6a213546db16ec20c6f3acd11ae7ad897f6a2dccd9a86fbb3830eece448a1801af3a30afd86ac31a1fc7732750e5becfe2bec1889cf2a80994e435a2577726ba4e542d7ffec41792dcea0e5d7332728fd19639c310508156a8dfac085eb64143815489d67d95205afb326c20abe3ace0f329199427445af5fa7e2df23b4c13ed6e7436cdae9011b913b19e5ca904c71d2c1f6ea779dccebc2e374f35b527a5e1b6b54b5b736045dfb605bb7e17b1cf739a3c129f5f290f47a3556a19c9f9cc13ad90330584e6b0b5b37c8a1c756fff5cb8298f80121e1784a033f93ce8a490b5dd9206a2b8d241aff2711ecfd738acc490291f3b78021cd938cf6d4b34a75e3448cc693ce08f04658fb24c689497af9a221fa57c7ee158fda7e68b9b4459c983b6fd8e40aca5d509b815b8e508b7a351540de6666191c30487ea86bb9f9efcf67a07c242ff5649d8efd87eba60fa776ef5d4124333c65f5dbbd473885ab19a0f49ce45b86638744cf8a0568c051a8facb8de4fabf86b261439e85967fb50a6ba3546fef3f0381c099b5071ccb503ade6e38382c9e4d453380df7717abf5dc11e4c13df8b9df7422c8fe35556150fcd0b35784f7f8536d31f53866316f8f3525937774d343c5cf0d9bb5fe35aceb57b1cbcb3e375e5b89dd6e344c1609f954881bc3bd5d577d12c598bf354d2b0a42d936269f3e86b459eae69ab9b61c4231f84cb1bf046a421fd4faa4e616400e1ba301f23074fba27cbf13ebae9fe25fcc1d81c3f8bee4e08d406186e8c1b97ab91e9ea9bf7191111052741128c066a944c80240046ebba010d18c748573b61980d742e61501bd76c98d198694868e3f4b5e1803b1afd5a1ff7265168a58e7ff84b0979679b1f60d5f3bc7dd76e9b062d2c2ee6f97e2816cb7545ebad1faa4dba20896906cf9bf6a841a0fdc102c933dbbdfc4b10f3719e0c6720221c44e4ad21ed92b485e6ffdc2f5dfafc2beba40c66534e5fbf4ebd04a591de51bfb71efa95d45572510b74888752fb57d9422ea6e292d990e37192060771b19881a17a7566b264911ae35fb2368d4a90cb2919fa6695e448adb56758b12544a41529b3138396a9c0edbb5f6fb369909514582b5dccf557d042289c267add8f7db8d76f6e15498a019bbf9dfc558d743a11ab64b038616f7bf13ebfeb52b0f7985fd25