syzkaller login: [ 268.077647][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 277.276755][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 277.297916][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 314.605864][ T1858] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:20635' (ECDSA) to the list of known hosts. 1970/01/01 00:06:02 fuzzer started 1970/01/01 00:06:14 dialing manager at localhost:38841 [ 380.557596][ T2043] cgroup: Unknown subsys name 'net' [ 381.593699][ T2043] cgroup: Unknown subsys name 'rlimit' 1970/01/01 00:06:21 syscalls: 2918 1970/01/01 00:06:21 code coverage: enabled 1970/01/01 00:06:21 comparison tracing: enabled 1970/01/01 00:06:21 extra coverage: enabled 1970/01/01 00:06:21 delay kcov mmap: mmap returned an invalid pointer 1970/01/01 00:06:21 setuid sandbox: enabled 1970/01/01 00:06:21 namespace sandbox: enabled 1970/01/01 00:06:21 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:06:21 fault injection: enabled 1970/01/01 00:06:21 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:06:21 net packet injection: enabled 1970/01/01 00:06:21 net device setup: enabled 1970/01/01 00:06:21 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:06:21 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:06:21 NIC VF setup: PCI device 0000:00:11.0 is not available 1970/01/01 00:06:21 USB emulation: enabled 1970/01/01 00:06:21 hci packet injection: /dev/vhci does not exist 1970/01/01 00:06:21 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:06:21 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:06:21 fetching corpus: 0, signal 0/2000 (executing program) 1970/01/01 00:06:26 fetching corpus: 50, signal 28761/32143 (executing program) 1970/01/01 00:06:29 fetching corpus: 100, signal 40863/45554 (executing program) 1970/01/01 00:06:33 fetching corpus: 149, signal 53167/58923 (executing program) 1970/01/01 00:06:37 fetching corpus: 198, signal 60255/67204 (executing program) 1970/01/01 00:06:40 fetching corpus: 248, signal 67962/75864 (executing program) 1970/01/01 00:06:43 fetching corpus: 298, signal 73800/82578 (executing program) 1970/01/01 00:06:46 fetching corpus: 348, signal 76870/86615 (executing program) 1970/01/01 00:06:48 fetching corpus: 398, signal 80752/91372 (executing program) 1970/01/01 00:06:51 fetching corpus: 448, signal 85496/96813 (executing program) 1970/01/01 00:06:53 fetching corpus: 498, signal 89113/101156 (executing program) 1970/01/01 00:06:55 fetching corpus: 548, signal 92898/105563 (executing program) 1970/01/01 00:06:59 fetching corpus: 597, signal 96051/109346 (executing program) 1970/01/01 00:07:02 fetching corpus: 647, signal 99298/113136 (executing program) 1970/01/01 00:07:05 fetching corpus: 697, signal 102601/116941 (executing program) 1970/01/01 00:07:07 fetching corpus: 747, signal 105133/119986 (executing program) 1970/01/01 00:07:11 fetching corpus: 797, signal 106900/122352 (executing program) 1970/01/01 00:07:14 fetching corpus: 847, signal 108902/124908 (executing program) 1970/01/01 00:07:17 fetching corpus: 896, signal 112000/128339 (executing program) 1970/01/01 00:07:20 fetching corpus: 945, signal 113324/130225 (executing program) 1970/01/01 00:07:23 fetching corpus: 995, signal 115476/132727 (executing program) 1970/01/01 00:07:26 fetching corpus: 1045, signal 117446/135122 (executing program) 1970/01/01 00:07:30 fetching corpus: 1094, signal 119397/137403 (executing program) 1970/01/01 00:07:33 fetching corpus: 1144, signal 120996/139384 (executing program) 1970/01/01 00:07:35 fetching corpus: 1194, signal 121981/140889 (executing program) 1970/01/01 00:07:37 fetching corpus: 1243, signal 123476/142677 (executing program) 1970/01/01 00:07:39 fetching corpus: 1293, signal 126150/145320 (executing program) 1970/01/01 00:07:42 fetching corpus: 1343, signal 127783/147218 (executing program) 1970/01/01 00:07:44 fetching corpus: 1393, signal 129246/148956 (executing program) 1970/01/01 00:07:48 fetching corpus: 1443, signal 130809/150722 (executing program) 1970/01/01 00:07:51 fetching corpus: 1493, signal 132037/152218 (executing program) 1970/01/01 00:07:55 fetching corpus: 1543, signal 133219/153658 (executing program) 1970/01/01 00:07:57 fetching corpus: 1592, signal 134135/154980 (executing program) 1970/01/01 00:08:00 fetching corpus: 1641, signal 135098/156219 (executing program) 1970/01/01 00:08:03 fetching corpus: 1691, signal 136853/158004 (executing program) 1970/01/01 00:08:06 fetching corpus: 1740, signal 138362/159539 (executing program) 1970/01/01 00:08:09 fetching corpus: 1790, signal 139987/161173 (executing program) 1970/01/01 00:08:11 fetching corpus: 1840, signal 141645/162730 (executing program) 1970/01/01 00:08:14 fetching corpus: 1889, signal 143267/164300 (executing program) 1970/01/01 00:08:16 fetching corpus: 1939, signal 144899/165828 (executing program) 1970/01/01 00:08:18 fetching corpus: 1989, signal 146121/167060 (executing program) 1970/01/01 00:08:21 fetching corpus: 2039, signal 147121/168120 (executing program) 1970/01/01 00:08:24 fetching corpus: 2089, signal 148656/169451 (executing program) 1970/01/01 00:08:26 fetching corpus: 2139, signal 149710/170537 (executing program) 1970/01/01 00:08:28 fetching corpus: 2189, signal 151099/171746 (executing program) 1970/01/01 00:08:31 fetching corpus: 2239, signal 152319/172895 (executing program) 1970/01/01 00:08:32 fetching corpus: 2289, signal 153574/174001 (executing program) 1970/01/01 00:08:35 fetching corpus: 2339, signal 154864/175080 (executing program) 1970/01/01 00:08:37 fetching corpus: 2389, signal 155607/175864 (executing program) 1970/01/01 00:08:39 fetching corpus: 2438, signal 156181/176568 (executing program) 1970/01/01 00:08:42 fetching corpus: 2486, signal 157079/177417 (executing program) 1970/01/01 00:08:45 fetching corpus: 2536, signal 158380/178431 (executing program) 1970/01/01 00:08:48 fetching corpus: 2586, signal 159509/179369 (executing program) 1970/01/01 00:08:51 fetching corpus: 2635, signal 160597/180277 (executing program) 1970/01/01 00:08:54 fetching corpus: 2685, signal 161433/181010 (executing program) 1970/01/01 00:08:56 fetching corpus: 2735, signal 162338/181769 (executing program) 1970/01/01 00:08:58 fetching corpus: 2785, signal 163577/182654 (executing program) 1970/01/01 00:09:01 fetching corpus: 2835, signal 164627/183415 (executing program) 1970/01/01 00:09:03 fetching corpus: 2885, signal 165489/184105 (executing program) 1970/01/01 00:09:06 fetching corpus: 2934, signal 166399/184818 (executing program) 1970/01/01 00:09:08 fetching corpus: 2984, signal 167927/185707 (executing program) 1970/01/01 00:09:11 fetching corpus: 3034, signal 169009/186433 (executing program) 1970/01/01 00:09:13 fetching corpus: 3084, signal 170513/187241 (executing program) 1970/01/01 00:09:16 fetching corpus: 3134, signal 171291/187765 (executing program) 1970/01/01 00:09:19 fetching corpus: 3184, signal 171732/188152 (executing program) 1970/01/01 00:09:22 fetching corpus: 3233, signal 172518/188697 (executing program) 1970/01/01 00:09:24 fetching corpus: 3282, signal 173194/189155 (executing program) 1970/01/01 00:09:26 fetching corpus: 3332, signal 174070/189687 (executing program) 1970/01/01 00:09:30 fetching corpus: 3382, signal 174982/190203 (executing program) 1970/01/01 00:09:33 fetching corpus: 3430, signal 176353/190783 (executing program) 1970/01/01 00:09:37 fetching corpus: 3480, signal 177186/191219 (executing program) 1970/01/01 00:09:40 fetching corpus: 3529, signal 178106/191687 (executing program) 1970/01/01 00:09:44 fetching corpus: 3579, signal 179128/192158 (executing program) 1970/01/01 00:09:48 fetching corpus: 3628, signal 179840/192469 (executing program) 1970/01/01 00:09:50 fetching corpus: 3677, signal 180455/192864 (executing program) 1970/01/01 00:09:51 fetching corpus: 3725, signal 181130/193195 (executing program) 1970/01/01 00:09:53 fetching corpus: 3775, signal 181753/193505 (executing program) 1970/01/01 00:09:56 fetching corpus: 3825, signal 182410/193816 (executing program) 1970/01/01 00:09:59 fetching corpus: 3875, signal 183396/194182 (executing program) 1970/01/01 00:10:03 fetching corpus: 3925, signal 184032/194442 (executing program) 1970/01/01 00:10:07 fetching corpus: 3975, signal 184527/194665 (executing program) 1970/01/01 00:10:09 fetching corpus: 4025, signal 185067/194903 (executing program) 1970/01/01 00:10:11 fetching corpus: 4075, signal 185738/195140 (executing program) 1970/01/01 00:10:14 fetching corpus: 4125, signal 186395/195324 (executing program) 1970/01/01 00:10:17 fetching corpus: 4175, signal 186943/195500 (executing program) 1970/01/01 00:10:20 fetching corpus: 4224, signal 187541/195680 (executing program) 1970/01/01 00:10:22 fetching corpus: 4273, signal 188158/195861 (executing program) 1970/01/01 00:10:23 fetching corpus: 4322, signal 188601/196005 (executing program) 1970/01/01 00:10:27 fetching corpus: 4372, signal 190704/196294 (executing program) 1970/01/01 00:10:29 fetching corpus: 4422, signal 191452/196417 (executing program) 1970/01/01 00:10:31 fetching corpus: 4472, signal 192199/196527 (executing program) 1970/01/01 00:10:34 fetching corpus: 4521, signal 192842/196600 (executing program) 1970/01/01 00:10:37 fetching corpus: 4571, signal 193692/196697 (executing program) 1970/01/01 00:10:38 fetching corpus: 4602, signal 194171/196768 (executing program) 1970/01/01 00:10:38 fetching corpus: 4602, signal 194171/196805 (executing program) 1970/01/01 00:10:38 fetching corpus: 4602, signal 194171/196830 (executing program) 1970/01/01 00:10:39 fetching corpus: 4602, signal 194171/196867 (executing program) 1970/01/01 00:10:39 fetching corpus: 4602, signal 194171/196905 (executing program) 1970/01/01 00:10:39 fetching corpus: 4602, signal 194171/196915 (executing program) 1970/01/01 00:10:39 fetching corpus: 4602, signal 194171/196915 (executing program) 1970/01/01 00:12:25 starting 2 fuzzer processes 00:12:25 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100), 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000180)) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x15, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000000), 0x81, r0}, 0x38) 00:12:25 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) [ 773.362520][ T2056] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 773.926746][ T2056] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 774.517982][ T2057] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 775.031088][ T2057] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 785.440669][ T2056] device hsr_slave_0 entered promiscuous mode [ 785.483338][ T2056] device hsr_slave_1 entered promiscuous mode [ 787.003099][ T2057] device hsr_slave_0 entered promiscuous mode [ 787.041044][ T2057] device hsr_slave_1 entered promiscuous mode [ 787.051963][ T2057] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 787.055051][ T2057] Cannot create hsr debugfs directory [ 793.907447][ T2057] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 794.105464][ T2057] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 794.432297][ T2057] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 794.557313][ T2057] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 795.794168][ T2056] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 796.136143][ T2056] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 796.310606][ T2056] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 796.376495][ T2056] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 805.475988][ T2057] 8021q: adding VLAN 0 to HW filter on device bond0 [ 806.433185][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 806.514569][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 807.336782][ T2056] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.723537][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 807.784437][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 813.899975][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 813.924254][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 814.175786][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 814.236375][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 814.857269][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 814.913801][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 814.931472][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 814.953655][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 815.113274][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 815.136840][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 815.432250][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 815.733151][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 816.146472][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 816.177919][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 816.475654][ T2120] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 816.516069][ T2120] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 816.800784][ T2057] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 817.174109][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 817.193368][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 817.547732][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 817.594317][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 817.880840][ T2056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 823.427180][ T2120] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 823.434026][ T2120] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 823.696416][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 823.704441][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 840.063860][ T829] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 840.136146][ T829] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 842.232325][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 842.252213][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 847.250252][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 847.298013][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 847.439824][ T2057] device veth0_vlan entered promiscuous mode [ 847.511845][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 847.561520][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 847.993555][ T2057] device veth1_vlan entered promiscuous mode [ 849.195275][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 849.260858][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 849.573613][ T2056] device veth0_vlan entered promiscuous mode [ 849.821682][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 849.840973][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 849.860871][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 849.887071][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 850.176376][ T2057] device veth0_macvtap entered promiscuous mode [ 850.252591][ T2056] device veth1_vlan entered promiscuous mode [ 850.559865][ T2057] device veth1_macvtap entered promiscuous mode [ 850.966506][ T2686] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 851.677168][ T2121] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 851.697707][ T2121] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 852.043868][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 852.095270][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 852.132518][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 852.162920][ T82] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 852.425996][ T2057] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.431354][ T2057] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.433123][ T2057] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.434722][ T2057] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 852.574191][ T2056] device veth0_macvtap entered promiscuous mode [ 853.013288][ T2056] device veth1_macvtap entered promiscuous mode [ 853.165313][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 854.513480][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 854.573013][ T2673] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 855.368104][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 855.405960][ T2045] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 855.536383][ T2056] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 855.537739][ T2056] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 855.602799][ T2056] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 855.604694][ T2056] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 00:14:20 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100), 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000180)) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x15, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000000), 0x81, r0}, 0x38) 00:14:24 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:24 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100), 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000180)) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x15, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000000), 0x81, r0}, 0x38) 00:14:30 executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100), 0x40) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000180)) statx(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x15, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140), &(0x7f0000000000), 0x81, r0}, 0x38) 00:14:32 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:37 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:41 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:46 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:50 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:55 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:14:59 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:15:05 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:05 executing program 1: r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmmsg$sock(r1, &(0x7f0000004580)=[{{&(0x7f0000000000)=@in={0x2, 0x0, @loopback=0x4874045}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000180)='\a', 0x1}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r0, 0x84, 0x76, &(0x7f00000000c0)={r3}, 0x8) 00:15:11 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000000000000900010073797a31000000002c000000080a01010000000000000000000000000900010073797a3100000000090002007379"], 0x74}}, 0x0) 00:15:12 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:14 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000000000000900010073797a31000000002c000000080a01010000000000000000000000000900010073797a3100000000090002007379"], 0x74}}, 0x0) 00:15:17 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000000000000900010073797a31000000002c000000080a01010000000000000000000000000900010073797a3100000000090002007379"], 0x74}}, 0x0) 00:15:21 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:21 executing program 1: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000000000000900010073797a31000000002c000000080a01010000000000000000000000000900010073797a3100000000090002007379"], 0x74}}, 0x0) 00:15:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:27 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:38 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:45 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:55 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:15:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:16:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r2}]}}}]}, 0x4c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8}]}}}]}, 0x4c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @sit={{0x8}, {0x20, 0x2, 0x0, 0x1, [@IFLA_IPTUN_6RD_PREFIX={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @local}}, @IFLA_IPTUN_LINK={0x8, 0x1, r6}]}}}]}, 0x4c}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'tunl0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0xff, 0x20, {{0x6, 0x4, 0x0, 0x7, 0x18, 0x64, 0x0, 0x7f, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x3a}, {[@end, @noop]}}}}}) socket$inet_udp(0x2, 0x2, 0x0) 00:16:09 executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendfile(r1, r0, 0x0, 0xffffffff) ppoll(&(0x7f0000003800)=[{r1, 0x24}], 0x1, &(0x7f0000003640), 0x0, 0x0) [ 971.735421][ C0] ================================================================== [ 971.739876][ C0] BUG: KASAN: use-after-free in walk_stackframe+0x11c/0x260 [ 971.741268][ C0] Read of size 8 at addr ffffaf8007debec0 by task syz-executor.1/2946 [ 971.743119][ C0] [ 971.745515][ C0] CPU: 0 PID: 2946 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 971.747190][ C0] Hardware name: riscv-virtio,qemu (DT) [ 971.748458][ C0] Call Trace: [ 971.749600][ C0] [] dump_backtrace+0x2e/0x3c [ 971.750915][ C0] [] show_stack+0x34/0x40 [ 971.752019][ C0] [] dump_stack_lvl+0xe4/0x150 [ 971.753234][ C0] [] print_address_description.constprop.0+0x2a/0x330 [ 971.754949][ C0] [] kasan_report+0x184/0x1e0 [ 971.756293][ C0] [] __asan_load8+0x6e/0x96 [ 971.757539][ C0] [] walk_stackframe+0x11c/0x260 [ 971.759398][ C0] [] arch_stack_walk+0x2c/0x3c [ 971.761201][ C0] [] stack_trace_save+0xa6/0xd8 [ 971.762404][ C0] [] kasan_save_stack+0x2c/0x58 [ 971.763833][ C0] [ 971.764634][ C0] The buggy address belongs to the page: [ 971.766460][ C0] page:ffffaf807a87fa18 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x87feb [ 971.767965][ C0] flags: 0x8000000000(section=16|node=0|zone=0) [ 971.770723][ C0] raw: 0000008000000000 ffffaf807aeaa890 ffffaf807aa4a318 0000000000000000 [ 971.772063][ C0] raw: 0000000000000000 ffffaf800b785060 00000000ffffffff 0000000000000000 [ 971.773385][ C0] raw: 00000000000007ff [ 971.774281][ C0] page dumped because: kasan: bad access detected [ 971.775416][ C0] page_owner tracks the page as freed [ 971.776327][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), pid 2061, ts 960029833300, free_ts 960090611000 [ 971.779884][ C0] __set_page_owner+0x48/0x136 [ 971.781497][ C0] post_alloc_hook+0xd0/0x10a [ 971.782638][ C0] get_page_from_freelist+0x8da/0x12d8 [ 971.784360][ C0] __alloc_pages+0x150/0x3b6 [ 971.785390][ C0] copy_process+0x482/0x3c34 [ 971.786407][ C0] kernel_clone+0xee/0x920 [ 971.787390][ C0] kernel_thread+0xf8/0x130 [ 971.788467][ C0] call_usermodehelper_exec_work+0xc8/0x122 [ 971.789674][ C0] process_one_work+0x654/0xffe [ 971.790667][ C0] worker_thread+0x360/0x8fa [ 971.791766][ C0] kthread+0x19e/0x1fa [ 971.793138][ C0] ret_from_exception+0x0/0x10 [ 971.794426][ C0] page last free stack trace: [ 971.795187][ C0] __reset_page_owner+0x4a/0xea [ 971.796279][ C0] free_pcp_prepare+0x29c/0x45e [ 971.797337][ C0] free_unref_page+0x6a/0x31e [ 971.798470][ C0] __free_pages+0xe2/0x112 [ 971.799925][ C0] put_task_stack+0x1d0/0x2b0 [ 971.800984][ C0] finish_task_switch.isra.0+0x3ce/0x420 [ 971.802134][ C0] __schedule+0x58e/0x118e [ 971.803197][ C0] preempt_schedule_common+0x4e/0xde [ 971.804318][ C0] preempt_schedule+0x34/0x36 [ 971.805429][ C0] _raw_spin_unlock_irqrestore+0x8c/0x98 [ 971.806548][ C0] remove_wait_queue+0x9e/0xb4 [ 971.807557][ C0] do_wait+0x442/0x894 [ 971.808835][ C0] kernel_wait4+0x158/0x296 [ 971.810204][ C0] __do_sys_wait4+0x14a/0x156 [ 971.811241][ C0] sys_wait4+0x30/0x40 [ 971.812219][ C0] ret_from_syscall+0x0/0x2 [ 971.813453][ C0] [ 971.814107][ C0] Memory state around the buggy address: [ 971.815354][ C0] ffffaf8007debd80: 00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 [ 971.816502][ C0] ffffaf8007debe00: 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff [ 971.817608][ C0] >ffffaf8007debe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 971.818823][ C0] ^ [ 971.820155][ C0] ffffaf8007debf00: ff ff ff ff f1 f1 f1 f1 00 00 00 f3 f3 f3 f3 f3 [ 971.821367][ C0] ffffaf8007debf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 971.822553][ C0] ================================================================== [ 971.823610][ C0] Disabling lock debugging due to kernel taint [ 971.836345][ T2946] Kernel panic - not syncing: corrupted stack end detected inside scheduler [ 971.837700][ T2946] CPU: 0 PID: 2946 Comm: syz-executor.1 Tainted: G B 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 [ 971.839744][ T2946] Hardware name: riscv-virtio,qemu (DT) [ 971.840816][ T2946] Call Trace: [ 971.841460][ T2946] [] dump_backtrace+0x2e/0x3c [ 971.842705][ T2946] [] show_stack+0x34/0x40 [ 971.843848][ T2946] [] dump_stack_lvl+0xe4/0x150 [ 971.844963][ T2946] [] dump_stack+0x1c/0x24 [ 971.846115][ T2946] [] panic+0x24a/0x634 [ 971.847025][ T2946] [] schedule+0x0/0x14c [ 971.848368][ T2946] [] preempt_schedule_irq+0x4a/0x13e [ 971.849550][ T2946] [] resume_kernel+0x16/0x18 [ 971.850838][ T2946] SMP: stopping secondary CPUs [ 971.853239][ T2946] Rebooting in 86400 seconds.. VM DIAGNOSIS: 19:44:35 Registers: info registers vcpu 0 pc ffffffff80c2b612 mhartid 0000000000000000 mstatus 00000000000000a0 mip 00000000000000a0 mie 000000000000022a mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff80475986 sepc ffffffff80200a9c mcause 8000000000000007 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff8011c7fa x2/sp ffffaf8007deb8d0 x3/gp ffffffff85863ac0 x4/tp ffffaf800baf0000 x5/t0 ffffaf8007deb983 x6/t1 fffff5ef00fbd730 x7/t2 0000000000000000 x8/s0 ffffaf8007deb900 x9/s1 ffffffff86bcb640 x10/a0 ffffffff86bcb640 x11/a1 000000000000000a x12/a2 0000000000000000 x13/a3 ffffffff8011c7ec x14/a4 ffffaf800baf0000 x15/a5 0000000000000000 x16/a6 ffffaf8007deb987 x17/a7 ffffaf8007deb985 x18/s2 ffffffff86bcb641 x19/s3 ffffffff86bcb640 x20/s4 000000000000000a x21/s5 0000000000000017 x22/s6 0000000000000000 x23/s7 0000000000000400 x24/s8 ffffaf8007deb970 x25/s9 0000000000000000 x26/s10 00000000000003e7 x27/s11 ffffaf8007debbc0 x28/t3 0000000000000043 x29/t4 fffff5ef00fbd730 x30/t5 fffff5ef00fbd731 x31/t6 ffffaf8007deb986 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffff82d59fe8 mhartid 0000000000000001 mstatus 00000000000000a0 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffff800055d4 mepc ffffffff8000f97e sepc ffffffff831afd22 mcause 0000000000000009 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffff82d62dac x2/sp ffffaf800743b080 x3/gp ffffffff85863ac0 x4/tp ffffaf8007416100 x5/t0 ffffaf800743b588 x6/t1 e78e27d249f2a500 x7/t2 00007ffff9c941b7 x8/s0 ffffaf800743b000 x9/s1 ffffaf800c0cf8a0 x10/a0 ffffffff83629160 x11/a1 0000000000000100 x12/a2 0000000000000100 x13/a3 ffffffff831a264a x14/a4 ffffaf8007416100 x15/a5 ffffaf805a9e4840 x16/a6 0000000000f00000 x17/a7 ffffaf800743b2c0 x18/s2 0000000000000000 x19/s3 ffffffff838a05a0 x20/s4 ffffaf800743b2c0 x21/s5 ffffffff8343c840 x22/s6 ffffffffffffffff x23/s7 0000000000000022 x24/s8 ffffffff86c1a620 x25/s9 0000000000000001 x26/s10 0000000000000000 x27/s11 ffffffff84a0c540 x28/t3 fffffffff3f3f3f3 x29/t4 ffffffff82d62b5e x30/t5 1ffff5f000e87624 x31/t6 ffffaf800eb47408 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000