40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000002500)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)={0x8c, r9, 0x304, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1f}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000000}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfe0}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000002740)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002700)={&(0x7f00000025c0)={0x138, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_macvtap\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x45}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x14}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010100}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x4}, 0x80) 00:03:17 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000002500)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)={0x8c, r9, 0x304, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1f}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000000}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfe0}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000002740)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002700)={&(0x7f00000025c0)={0x138, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_macvtap\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x45}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x14}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010100}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x4}, 0x80) 00:03:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:17 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:17 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x0, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:17 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000002500)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)={0x8c, r9, 0x304, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1f}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000000}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfe0}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000002740)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002700)={&(0x7f00000025c0)={0x138, 0x0, 0x0, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_macvtap\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x45}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6}]}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x14}}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010100}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'sh\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}]}]}, 0x138}, 0x1, 0x0, 0x0, 0x4}, 0x80) 00:03:17 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0x0, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, 0xffffffffffffffff, 0x0, &(0x7f0000001dc0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x80000000}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r1, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:17 executing program 2: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, 0xffffffffffffffff, 0x0, &(0x7f0000001dc0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x80000000}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r1, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:17 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:17 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, 0xffffffffffffffff, 0x0, &(0x7f0000001dc0)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x80000000}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r1, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:17 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000002500)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)={0x8c, r9, 0x304, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1f}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000000}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfe0}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 2: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) sendmsg$IPVS_CMD_DEL_DEST(r4, &(0x7f0000002500)={&(0x7f00000023c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000024c0)={&(0x7f0000002400)={0x8c, r9, 0x304, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1f}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000000}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfe0}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 2: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000002280)={&(0x7f00000021c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002240)={&(0x7f0000002200)={0x1c, r8, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x8000) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r4, &(0x7f0000002380)={&(0x7f00000022c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002340)={&(0x7f0000002300)={0x1c, r6, 0x4, 0x70bd28, 0x25dfdbfb, {{}, {@void, @void}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x1b}]}, 0x1c}}, 0x4890) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) sendmsg$TIPC_CMD_GET_MAX_PORTS(r10, &(0x7f0000002180)={&(0x7f0000002080), 0xc, &(0x7f0000002140)={&(0x7f0000002100)={0x1c, r11, 0x100, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x800) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x0, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000020c0), r1) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x0, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x0, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:18 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) 00:03:18 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) r0 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000002040)={&(0x7f0000001f80)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002000)={&(0x7f0000001fc0)={0x34, r9, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7488}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x4840}, 0x4) 00:03:18 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:18 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r4, &(0x7f0000001f40)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001f00)={&(0x7f0000001e00)={0x100, r9, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x400}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x81}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x7ff}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x8}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@private0}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xd3}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@private2}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x11}}]}]}, 0x100}}, 0x80) 00:03:18 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:18 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) r0 = syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:18 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x0, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r7, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x0, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) sendmsg$IPVS_CMD_GET_DAEMON(r0, &(0x7f0000001d80)={&(0x7f0000001c80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001d40)={&(0x7f0000001d00)={0x2c, r9, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x18, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x100}, 0x0) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) r0 = syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r6, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r7, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) syz_genetlink_get_family_id$ipvs(&(0x7f0000001cc0), r1) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) r0 = syz_genetlink_get_family_id$gtp(0x0, 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r0, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x0, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f0000001c40)={&(0x7f0000001b80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001c00)={&(0x7f0000001bc0)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_DTIM_PERIOD={0x8, 0xd, 0x4}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_PBSS={0x4}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4040) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x0, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) sendmsg$L2TP_CMD_SESSION_CREATE(r0, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001b00)={&(0x7f0000001ac0)={0x38, r8, 0x208, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xa948}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c050}, 0x4c003) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r5) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r5) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r6, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r7 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r7, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) syz_genetlink_get_family_id$l2tp(&(0x7f0000001a80), r4) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r4) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r5, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r6, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) sendmsg$L2TP_CMD_SESSION_MODIFY(r1, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x24, 0x0, 0x20, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x5}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x200}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r4) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r5, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000001900)={&(0x7f0000001800)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000018c0)={&(0x7f0000001880)={0x1c, r6, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x850}, 0x14) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r4) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r4) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r5, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) syz_genetlink_get_family_id$gtp(&(0x7f0000001840), r2) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) 00:03:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:19 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r2, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r3) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r3) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f00000017c0)={&(0x7f00000016c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001780)={&(0x7f0000001740)={0x1c, r4, 0x20, 0x70bd26, 0x25dfdbfb, {}, [@NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0xcd5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040880}, 0x4000) 00:03:19 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:19 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r2, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r3) syz_genetlink_get_family_id$nl80211(&(0x7f0000001700), r3) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0x0, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r2, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$mptcp(&(0x7f0000001640), r3) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0x0, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) sendmsg$NL80211_CMD_SET_WIPHY(r0, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x5c, r2, 0x200, 0x70bd2a, 0x25dfdbff, {}, [@NL80211_ATTR_WIPHY_TX_POWER_LEVEL={0x8, 0x62, 0x9}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x40}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x101}, @NL80211_ATTR_WIPHY_ANTENNA_TX={0x8, 0x69, 0x10001}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x5205}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8}, @NL80211_ATTR_WIPHY_ANTENNA_RX={0x8, 0x6a, 0x7ff}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}, @NL80211_ATTR_WIPHY_RTS_THRESHOLD={0x8, 0x40, 0x7}]}, 0x5c}}, 0x8000001) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:20 executing program 1: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r0, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r6}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r5, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000001500), r1) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:20 executing program 1: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0x0, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0]}, 0x40) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r5, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001480)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001440)={&(0x7f0000001400)={0x18, 0x0, 0x4, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x18}}, 0x0) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 1: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, r4, 0x2, 0x1}, 0x48) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 1: socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f0000001380)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001340)={&(0x7f0000001300)={0x20, 0x0, 0x300, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x2, 0x2c}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4101}, 0x40) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 1: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r1, 0x5000943f, &(0x7f00000002c0)={{r0}, 0x0, 0x16, @unused=[0xd5, 0x1, 0x1, 0x6], @devid}) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, r0, 0x2, 0x1}, 0x48) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x64, 0x0, 0x800, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x313}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x1}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4859}, 0x0) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:20 executing program 1: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$AUDIT_USER(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, 0x3ed, 0x800, 0x70bd25, 0x25dfdbfe, "25b08463437bde05cea92ce47deb93ca1363b76eb081fef6827f928186da165ce08d8c608900ee4377d26435ee66d5b699213ae2de7ecc2c9750d7faacb661613e44c3db5deb63ceddd0164cbfe0bd9fbae50cbb814f21ebd2d4a668de0d2e15a669cb345fa8", ["", "", "", "", "", "", ""]}, 0x78}, 0x1, 0x0, 0x0, 0x20000000}, 0x40400c0) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 1: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:20 executing program 3: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0x0, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 0: socketpair(0x6, 0x6, 0x0, &(0x7f0000000000)) socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:20 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:20 executing program 0: socketpair(0x9, 0x3, 0x68, &(0x7f0000001680)) 00:03:20 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:20 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) 00:03:20 executing program 0: socketpair(0x0, 0x3, 0x68, &(0x7f0000001680)) 00:03:21 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:21 executing program 3: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{}, &(0x7f0000002700), &(0x7f0000002740)}, 0x20) 00:03:21 executing program 0: socketpair(0x0, 0x3, 0x68, &(0x7f0000001680)) 00:03:21 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 1: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:21 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0x0, 0x0, &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 0: socketpair(0x0, 0x3, 0x68, &(0x7f0000001680)) 00:03:21 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r2, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r2, r1, 0x3, 0xc, 0x0, @link_fd=r3, r6}, 0x20) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r4, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r2, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r1}, 0x20) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r5, 0x9, '\x00', 0x0, r3, 0x2, 0x1, 0x1}, 0x48) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r7, 0x0, &(0x7f0000001dc0)=[r8, r9, r10, r11, r2, r3], 0x0, 0x10, 0x80000000}, 0x90) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r3, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r12}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r13, 0x0, r3, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r14 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r3) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r14, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r11}, &(0x7f0000002640), &(0x7f0000002680)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r9}, &(0x7f0000002700), &(0x7f0000002740)=r7}, 0x20) 00:03:21 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:21 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:21 executing program 0: socketpair(0x9, 0x0, 0x68, &(0x7f0000001680)) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r2, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r2, r1, 0x3, 0xc, 0x0, @link_fd=r3, r6}, 0x20) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r4, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r2, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r1}, 0x20) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r5, 0x9, '\x00', 0x0, r3, 0x2, 0x1, 0x1}, 0x48) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r7, 0x0, &(0x7f0000001dc0)=[r8, r9, r10, r11, r2, r3], 0x0, 0x10, 0x80000000}, 0x90) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r3, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r12}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r13, 0x0, r3, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r14 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r3) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r14, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r11}, &(0x7f0000002640), &(0x7f0000002680)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r9}, &(0x7f0000002700), &(0x7f0000002740)=r7}, 0x20) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0x0, 0x0, &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x78, r2, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x9}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x800}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'macsec0\x00'}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0xf8}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x3}, @L2TP_ATTR_DEBUG={0x8}]}, 0x78}, 0x1, 0x0, 0x0, 0x20000811}, 0x2c004442) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000180)={{r1}, 0x0, 0x1a, @unused=[0x80d2, 0xd612, 0x8], @subvolid=0x9}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x38, 0x0, 0x400, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x1c, 0x2a, [@gcr_ga={0xbd, 0x6, @broadcast}, @supported_rates={0x1, 0x6, [{0x60, 0x1}, {0xb}, {0x60}, {0x6c}, {0x12, 0x1}, {0x36}]}, @mesh_chsw={0x76, 0x6, {0xd8, 0x1, 0xb, 0x4ea}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000050}, 0x90) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001380)={&(0x7f0000001280)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000001340)={&(0x7f00000012c0)={0x50, r2, 0x400, 0x8, 0x25dfdbfc, {}, [@L2TP_ATTR_FD={0x8, 0x17, @udp6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x8000000000000001}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x64}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x50}, 0x1, 0x0, 0x0, 0x4080000}, 0x800) r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000001400), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000014c0)={&(0x7f00000013c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x2c, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@GTPA_I_TEI={0x8, 0x8, 0x3}, @GTPA_I_TEI={0x8, 0x8, 0x4}, @GTPA_NET_NS_FD={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008001}, 0x4000) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001540)={0x54, r2, 0x200, 0x70bd27, 0x25dfdbfe, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x20}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xa296}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x3}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'syzkaller0\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x8054) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000001680), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_MAX_PORTS(0xffffffffffffffff, &(0x7f0000001740)={&(0x7f0000001640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x1c, r4, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x804) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f00000017c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, r5, 0x702, 0x70bd2b, 0x25dfdbfd, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4040) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f00000018c0), 0xffffffffffffffff) socket$can_j1939(0x1d, 0x2, 0x7) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001940), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r7, &(0x7f0000001ac0)={&(0x7f0000001900)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000001a80)={&(0x7f0000001980)={0xd4, r8, 0x300, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x21}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'lblc\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x7}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10000}]}, 0xd4}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f0000001b00)={{0x0, 0x7, 0x40, 0xceda, 0x3, 0x7, 0x1, 0x4, 0x1f, 0x6, 0x81, 0x3, 0xf4, 0x6, 0x1ff}}) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002c00)={&(0x7f0000002b00)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002b40)={0x48, r6, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x3}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x4044014}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x300, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x80) sendmsg$L2TP_CMD_TUNNEL_CREATE(r7, &(0x7f0000002e00)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002dc0)={&(0x7f0000002d80)={0x1c, r6, 0x0, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x40}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000002e40)) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000002ec0), r7) sendmsg$L2TP_CMD_SESSION_CREATE(r7, &(0x7f0000002fc0)={&(0x7f0000002e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002f80)={&(0x7f0000002f00)={0x4c, r9, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40800}, 0x8801) r10 = syz_genetlink_get_family_id$l2tp(&(0x7f0000003040), r7) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r7, &(0x7f0000003100)={&(0x7f0000003000)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000030c0)={&(0x7f0000003080)={0x24, r10, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x800}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000000}, 0x40) r11 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r11, &(0x7f0000003280)={&(0x7f0000003140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000003240)={&(0x7f0000003180)={0x84, 0x0, 0x800, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x4, 0x5b}}}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "e52cdf261698df26b472955c763a3081"}, @NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x2b}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x9}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0xd72}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x6}, @NL80211_ATTR_FILS_CACHE_ID={0x6, 0xfd, 0x1}, @NL80211_ATTR_PMK={0x14, 0xfe, "7d61cbf227d0c27644cb8a206e59da3c"}]}, 0x84}, 0x1, 0x0, 0x0, 0x40}, 0x0) 00:03:21 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (fail_nth: 1) 00:03:21 executing program 0: socketpair(0x9, 0x0, 0x0, &(0x7f0000001680)) [ 201.482917][T30643] FAULT_INJECTION: forcing a failure. [ 201.482917][T30643] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 201.497429][T30643] CPU: 0 PID: 30643 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 201.499743][T30643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 201.502070][T30643] Call trace: [ 201.502896][T30643] dump_backtrace+0x1b8/0x1e4 [ 201.503929][T30643] show_stack+0x2c/0x3c [ 201.504857][T30643] dump_stack_lvl+0xd0/0x124 [ 201.505884][T30643] dump_stack+0x1c/0x28 [ 201.506783][T30643] should_fail_ex+0x3b0/0x50c [ 201.507808][T30643] should_fail+0x14/0x24 [ 201.508842][T30643] should_fail_usercopy+0x20/0x30 [ 201.509920][T30643] simple_read_from_buffer+0xd4/0x248 [ 201.511179][T30643] proc_fail_nth_read+0x134/0x1a0 [ 201.512317][T30643] vfs_read+0x284/0x8a4 [ 201.513186][T30643] ksys_read+0x15c/0x26c [ 201.514142][T30643] __arm64_sys_read+0x7c/0x90 [ 201.515217][T30643] invoke_syscall+0x98/0x2b8 [ 201.516171][T30643] el0_svc_common+0x130/0x23c [ 201.517208][T30643] do_el0_svc+0x48/0x58 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) [ 201.518148][T30643] el0_svc+0x54/0x158 [ 201.519007][T30643] el0t_64_sync_handler+0x84/0xfc [ 201.520299][T30643] el0t_64_sync+0x190/0x194 00:03:21 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:21 executing program 0: socketpair(0x9, 0x0, 0x0, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0x0, 0x0, &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e}, 0x8) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r2, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r2, r1, 0x3, 0xc, 0x0, @link_fd=r3, r6}, 0x20) r7 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r4, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r8 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r2, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r1}, 0x20) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r5, 0x9, '\x00', 0x0, r3, 0x2, 0x1, 0x1}, 0x48) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r7, 0x0, &(0x7f0000001dc0)=[r8, r9, r10, r11, r2, r3], 0x0, 0x10, 0x80000000}, 0x90) r12 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r3, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r12}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r13, 0x0, r3, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r14 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r3) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r14, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r11}, &(0x7f0000002640), &(0x7f0000002680)=r3}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r9}, &(0x7f0000002700), &(0x7f0000002740)=r7}, 0x20) 00:03:21 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000041}, 0x8851) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x50c4102}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x20040000) 00:03:21 executing program 0: socketpair(0x9, 0x0, 0x0, 0x0) 00:03:21 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 1) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 00:03:21 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000041}, 0x8851) (async) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x50c4102}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x20040000) 00:03:21 executing program 0: socketpair(0x9, 0x0, 0x0, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) [ 201.672155][T30669] FAULT_INJECTION: forcing a failure. [ 201.672155][T30669] name failslab, interval 1, probability 0, space 0, times 1 [ 201.678535][T30669] CPU: 1 PID: 30669 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 201.680944][T30669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 201.683425][T30669] Call trace: [ 201.684178][T30669] dump_backtrace+0x1b8/0x1e4 [ 201.685271][T30669] show_stack+0x2c/0x3c [ 201.686258][T30669] dump_stack_lvl+0xd0/0x124 [ 201.687332][T30669] dump_stack+0x1c/0x28 [ 201.688379][T30669] should_fail_ex+0x3b0/0x50c [ 201.689460][T30669] __should_failslab+0xc8/0x128 [ 201.690584][T30669] should_failslab+0x10/0x28 [ 201.691596][T30669] kmem_cache_alloc+0x80/0x410 [ 201.692587][T30669] getname_flags+0xd0/0x48c [ 201.693672][T30669] getname+0x28/0x38 [ 201.694495][T30669] do_sys_openat2+0xd0/0x1b8 [ 201.695498][T30669] __arm64_sys_openat+0x1f0/0x240 [ 201.696748][T30669] invoke_syscall+0x98/0x2b8 [ 201.697740][T30669] el0_svc_common+0x130/0x23c [ 201.698785][T30669] do_el0_svc+0x48/0x58 [ 201.699728][T30669] el0_svc+0x54/0x158 [ 201.700711][T30669] el0t_64_sync_handler+0x84/0xfc [ 201.701843][T30669] el0t_64_sync+0x190/0x194 00:03:21 executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000041}, 0x8851) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x50c4102}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x20040000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_LEAVE_MESH(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r0, 0x400, 0x70bd27, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r1}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000041}, 0x8851) (async) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x50c4102}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, 0x0, 0x4, 0x70bd2b, 0x25dfdbfe, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x1c}}, 0x20040000) (async) 00:03:21 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 2) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x0, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000000), r0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) [ 201.814507][T30701] FAULT_INJECTION: forcing a failure. [ 201.814507][T30701] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 201.817523][T30701] CPU: 0 PID: 30701 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 201.819730][T30701] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 201.822099][T30701] Call trace: [ 201.822862][T30701] dump_backtrace+0x1b8/0x1e4 [ 201.824022][T30701] show_stack+0x2c/0x3c [ 201.824930][T30701] dump_stack_lvl+0xd0/0x124 [ 201.825994][T30701] dump_stack+0x1c/0x28 [ 201.826901][T30701] should_fail_ex+0x3b0/0x50c [ 201.828063][T30701] should_fail+0x14/0x24 [ 201.829091][T30701] should_fail_usercopy+0x20/0x30 [ 201.830146][T30701] strncpy_from_user+0x48/0x54c [ 201.831245][T30701] getname_flags+0x104/0x48c [ 201.832291][T30701] getname+0x28/0x38 [ 201.833317][T30701] do_sys_openat2+0xd0/0x1b8 [ 201.834417][T30701] __arm64_sys_openat+0x1f0/0x240 [ 201.835618][T30701] invoke_syscall+0x98/0x2b8 [ 201.836674][T30701] el0_svc_common+0x130/0x23c [ 201.837770][T30701] do_el0_svc+0x48/0x58 [ 201.838695][T30701] el0_svc+0x54/0x158 [ 201.839640][T30701] el0t_64_sync_handler+0x84/0xfc [ 201.840767][T30701] el0t_64_sync+0x190/0x194 00:03:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) (async) syz_genetlink_get_family_id$team(&(0x7f0000000000), r0) (async) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:21 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x0, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:21 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 3) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:21 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000000), r0) (async) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) 00:03:21 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 00:03:21 executing program 2: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff}, 0x48) 00:03:21 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x0, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:22 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) [ 202.041282][T30737] FAULT_INJECTION: forcing a failure. [ 202.041282][T30737] name failslab, interval 1, probability 0, space 0, times 0 [ 202.058057][T30737] CPU: 1 PID: 30737 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 202.060461][T30737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 202.062728][T30737] Call trace: [ 202.063452][T30737] dump_backtrace+0x1b8/0x1e4 [ 202.064566][T30737] show_stack+0x2c/0x3c [ 202.065586][T30737] dump_stack_lvl+0xd0/0x124 [ 202.066646][T30737] dump_stack+0x1c/0x28 [ 202.067653][T30737] should_fail_ex+0x3b0/0x50c [ 202.068750][T30737] __should_failslab+0xc8/0x128 [ 202.069809][T30737] should_failslab+0x10/0x28 [ 202.070818][T30737] kmem_cache_alloc+0x80/0x410 [ 202.071917][T30737] alloc_empty_file+0xac/0x1d4 [ 202.072999][T30737] path_openat+0xd0/0x2888 [ 202.073986][T30737] do_filp_open+0x1bc/0x3cc [ 202.074948][T30737] do_sys_openat2+0x124/0x1b8 [ 202.076041][T30737] __arm64_sys_openat+0x1f0/0x240 [ 202.077139][T30737] invoke_syscall+0x98/0x2b8 [ 202.078122][T30737] el0_svc_common+0x130/0x23c [ 202.079128][T30737] do_el0_svc+0x48/0x58 [ 202.080089][T30737] el0_svc+0x54/0x158 [ 202.080955][T30737] el0t_64_sync_handler+0x84/0xfc [ 202.082066][T30737] el0t_64_sync+0x190/0x194 00:03:22 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x0, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 4) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:22 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x0, 0x0, &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) [ 202.185911][T30763] FAULT_INJECTION: forcing a failure. [ 202.185911][T30763] name failslab, interval 1, probability 0, space 0, times 0 00:03:22 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) (async) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) (async) [ 202.192382][T30763] CPU: 1 PID: 30763 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 202.194626][T30763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 202.197085][T30763] Call trace: [ 202.197800][T30763] dump_backtrace+0x1b8/0x1e4 [ 202.198859][T30763] show_stack+0x2c/0x3c [ 202.199777][T30763] dump_stack_lvl+0xd0/0x124 [ 202.200943][T30763] dump_stack+0x1c/0x28 [ 202.201957][T30763] should_fail_ex+0x3b0/0x50c [ 202.203058][T30763] __should_failslab+0xc8/0x128 [ 202.204159][T30763] should_failslab+0x10/0x28 [ 202.205215][T30763] kmem_cache_alloc+0x80/0x410 [ 202.206232][T30763] security_file_alloc+0x30/0x124 [ 202.207379][T30763] init_file+0x90/0x1f8 [ 202.208299][T30763] alloc_empty_file+0xc0/0x1d4 [ 202.209377][T30763] path_openat+0xd0/0x2888 [ 202.210401][T30763] do_filp_open+0x1bc/0x3cc [ 202.211443][T30763] do_sys_openat2+0x124/0x1b8 [ 202.212474][T30763] __arm64_sys_openat+0x1f0/0x240 [ 202.213631][T30763] invoke_syscall+0x98/0x2b8 [ 202.214662][T30763] el0_svc_common+0x130/0x23c [ 202.215814][T30763] do_el0_svc+0x48/0x58 [ 202.216743][T30763] el0_svc+0x54/0x158 [ 202.217647][T30763] el0t_64_sync_handler+0x84/0xfc [ 202.218841][T30763] el0t_64_sync+0x190/0x194 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x48) 00:03:22 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x0, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 5) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:22 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) (async) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) (async) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:22 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x48) 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x0, 0x0, &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 0: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00), 0x48) [ 202.373620][T30794] FAULT_INJECTION: forcing a failure. [ 202.373620][T30794] name failslab, interval 1, probability 0, space 0, times 0 00:03:22 executing program 2: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) [ 202.397818][T30794] CPU: 1 PID: 30794 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 202.400113][T30794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 202.402242][T30794] Call trace: [ 202.403014][T30794] dump_backtrace+0x1b8/0x1e4 [ 202.404116][T30794] show_stack+0x2c/0x3c [ 202.405063][T30794] dump_stack_lvl+0xd0/0x124 [ 202.406126][T30794] dump_stack+0x1c/0x28 [ 202.407040][T30794] should_fail_ex+0x3b0/0x50c [ 202.408044][T30794] __should_failslab+0xc8/0x128 [ 202.409112][T30794] should_failslab+0x10/0x28 [ 202.410253][T30794] __kmem_cache_alloc_node+0x80/0x368 [ 202.411437][T30794] __kmalloc+0xb8/0x1b8 [ 202.412468][T30794] tomoyo_realpath_from_path+0xc8/0x4cc [ 202.413885][T30794] tomoyo_check_open_permission+0x1ec/0x414 [ 202.415259][T30794] tomoyo_file_open+0x130/0x19c [ 202.416311][T30794] security_file_open+0x6c/0xb0 [ 202.417468][T30794] do_dentry_open+0x29c/0x12b4 [ 202.418552][T30794] vfs_open+0x7c/0x90 [ 202.419517][T30794] path_openat+0x1f6c/0x2888 [ 202.420596][T30794] do_filp_open+0x1bc/0x3cc [ 202.421652][T30794] do_sys_openat2+0x124/0x1b8 [ 202.422726][T30794] __arm64_sys_openat+0x1f0/0x240 [ 202.423975][T30794] invoke_syscall+0x98/0x2b8 [ 202.425022][T30794] el0_svc_common+0x130/0x23c [ 202.426229][T30794] do_el0_svc+0x48/0x58 [ 202.427176][T30794] el0_svc+0x54/0x158 [ 202.428128][T30794] el0t_64_sync_handler+0x84/0xfc [ 202.429343][T30794] el0t_64_sync+0x190/0x194 00:03:22 executing program 3: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 3: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)) (async) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) (async) 00:03:22 executing program 0: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) [ 202.462570][T30794] ERROR: Out of memory at tomoyo_realpath_from_path. 00:03:22 executing program 0: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:22 executing program 3: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)) (async) socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:22 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 6) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:22 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x0, 0x0, &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 3: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000b00)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x5a}}}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x2c}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x10) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001640)={{r0}, 0x0, 0xe, @unused=[0x0, 0x9, 0x3, 0xf539], @subvolid=0xfffffffffffffffc}) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180), r1) getpeername$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r6, 0x0, r5, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r8, 0x0, r7, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vxcan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r10, 0xc0c89425, 0x0) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000740), r7) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, r11, 0xa4885f25a8335a29, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4880}, 0x24004080) r12 = socket(0xa, 0x9, 0xcd0) bind$rxrpc(r12, &(0x7f00000006c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0x64010100}}, 0x24) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000280)={0x3b8, r3, 0xd10, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0x1d4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x66}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xcb}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x42d5}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff7}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8000}}, {0x8}}}]}}]}, 0x3b8}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000000) 00:03:22 executing program 0: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) [ 202.661543][T30837] FAULT_INJECTION: forcing a failure. [ 202.661543][T30837] name failslab, interval 1, probability 0, space 0, times 0 00:03:22 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) [ 202.679355][T30837] CPU: 0 PID: 30837 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 202.681581][T30837] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 202.683795][T30837] Call trace: [ 202.684508][T30837] dump_backtrace+0x1b8/0x1e4 [ 202.685613][T30837] show_stack+0x2c/0x3c [ 202.686505][T30837] dump_stack_lvl+0xd0/0x124 [ 202.687455][T30837] dump_stack+0x1c/0x28 [ 202.688515][T30837] should_fail_ex+0x3b0/0x50c [ 202.689574][T30837] __should_failslab+0xc8/0x128 [ 202.690692][T30837] should_failslab+0x10/0x28 [ 202.691684][T30837] __kmem_cache_alloc_node+0x80/0x368 [ 202.692901][T30837] __kmalloc+0xb8/0x1b8 [ 202.693874][T30837] tomoyo_encode+0x270/0x4b0 [ 202.694959][T30837] tomoyo_realpath_from_path+0x478/0x4cc [ 202.696197][T30837] tomoyo_check_open_permission+0x1ec/0x414 [ 202.697551][T30837] tomoyo_file_open+0x130/0x19c [ 202.698698][T30837] security_file_open+0x6c/0xb0 [ 202.699785][T30837] do_dentry_open+0x29c/0x12b4 [ 202.700861][T30837] vfs_open+0x7c/0x90 [ 202.701781][T30837] path_openat+0x1f6c/0x2888 [ 202.702814][T30837] do_filp_open+0x1bc/0x3cc [ 202.703865][T30837] do_sys_openat2+0x124/0x1b8 [ 202.704942][T30837] __arm64_sys_openat+0x1f0/0x240 [ 202.706124][T30837] invoke_syscall+0x98/0x2b8 [ 202.707095][T30837] el0_svc_common+0x130/0x23c [ 202.708153][T30837] do_el0_svc+0x48/0x58 [ 202.709009][T30837] el0_svc+0x54/0x158 [ 202.709984][T30837] el0t_64_sync_handler+0x84/0xfc [ 202.711183][T30837] el0t_64_sync+0x190/0x194 [ 202.733544][T30837] ERROR: Out of memory at tomoyo_realpath_from_path. 00:03:22 executing program 0: socketpair(0x27, 0x2, 0x3, &(0x7f0000000000)) 00:03:22 executing program 3: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000b00)) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000b00)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x5a}}}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x2c}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x10) (async) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x5a}}}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x2c}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x10) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001640)={{r0}, 0x0, 0xe, @unused=[0x0, 0x9, 0x3, 0xf539], @subvolid=0xfffffffffffffffc}) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001640)={{r0}, 0x0, 0xe, @unused=[0x0, 0x9, 0x3, 0xf539], @subvolid=0xfffffffffffffffc}) syz_genetlink_get_family_id$team(&(0x7f0000000180), r1) (async) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180), r1) getpeername$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14) (async) getpeername$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14) openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) (async) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r6, 0x0, r5, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00'}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r8, 0x0, r7, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vxcan1\x00', 0x0}) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r10, 0xc0c89425, 0x0) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000740), r7) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, r11, 0xa4885f25a8335a29, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4880}, 0x24004080) r12 = socket(0xa, 0x9, 0xcd0) bind$rxrpc(r12, &(0x7f00000006c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0x64010100}}, 0x24) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000280)={0x3b8, r3, 0xd10, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0x1d4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x66}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xcb}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x42d5}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff7}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8000}}, {0x8}}}]}}]}, 0x3b8}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000000) 00:03:22 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r2, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 7) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:22 executing program 0: socketpair(0x0, 0x2, 0x3, &(0x7f0000000000)) 00:03:22 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:22 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:22 executing program 0: socketpair(0x0, 0x2, 0x3, &(0x7f0000000000)) 00:03:22 executing program 3: epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000b00)) (async) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x800, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x5a}}}}, [@NL80211_ATTR_STATUS_CODE={0x6, 0x48, 0x2c}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x10) (async) ioctl$BTRFS_IOC_SNAP_CREATE_V2(r0, 0x50009417, &(0x7f0000001640)={{r0}, 0x0, 0xe, @unused=[0x0, 0x9, 0x3, 0xf539], @subvolid=0xfffffffffffffffc}) (async) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180), r1) getpeername$packet(r0, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000200)=0x14) (async) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) (async) sendmsg$GTP_CMD_DELPDP(r5, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r6, 0x0, r5, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) (async) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/consoles\x00', 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'vxcan0\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000ec0)={0x18, 0x4, &(0x7f0000000c00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7fffffff}, [@call={0x85, 0x0, 0x0, 0xb2}]}, &(0x7f0000000c40)='syzkaller\x00', 0x8, 0x98, &(0x7f0000000c80)=""/152, 0x41000, 0x14, '\x00', r8, 0x0, r7, 0x8, &(0x7f0000000d40)={0x8, 0x3}, 0x8, 0x10, &(0x7f0000000d80)={0x3, 0x0, 0x2}, 0x10}, 0x90) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000240)={'vxcan1\x00', 0x0}) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r10, 0xc0c89425, 0x0) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000740), r7) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, r11, 0xa4885f25a8335a29, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4880}, 0x24004080) r12 = socket(0xa, 0x9, 0xcd0) bind$rxrpc(r12, &(0x7f00000006c0)=@in4={0x21, 0x3, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0x64010100}}, 0x24) sendmsg$TEAM_CMD_NOOP(r0, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000280)={0x3b8, r3, 0xd10, 0x70bd25, 0x25dfdbff, {}, [{{0x8, 0x1, r4}, {0x1d4, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x66}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xcb}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3f}}}]}}, {{0x8}, {0x7c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x42d5}}}]}}, {{0x8}, {0xf0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffff7}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x8000}}, {0x8}}}]}}]}, 0x3b8}, 0x1, 0x0, 0x0, 0x20000001}, 0x4000000) [ 202.933572][T30877] FAULT_INJECTION: forcing a failure. [ 202.933572][T30877] name failslab, interval 1, probability 0, space 0, times 0 00:03:22 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) [ 202.953543][T30877] CPU: 1 PID: 30877 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 202.955862][T30877] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 202.958194][T30877] Call trace: [ 202.958938][T30877] dump_backtrace+0x1b8/0x1e4 [ 202.959995][T30877] show_stack+0x2c/0x3c [ 202.960910][T30877] dump_stack_lvl+0xd0/0x124 [ 202.961886][T30877] dump_stack+0x1c/0x28 [ 202.962773][T30877] should_fail_ex+0x3b0/0x50c [ 202.963803][T30877] __should_failslab+0xc8/0x128 [ 202.964883][T30877] should_failslab+0x10/0x28 [ 202.965881][T30877] __kmem_cache_alloc_node+0x80/0x368 [ 202.967057][T30877] kmalloc_trace+0x3c/0x88 [ 202.968109][T30877] virtual_ncidev_open+0x5c/0x1bc [ 202.969268][T30877] misc_open+0x2f0/0x368 [ 202.970347][T30877] chrdev_open+0x3c8/0x4dc [ 202.971330][T30877] do_dentry_open+0x778/0x12b4 [ 202.972359][T30877] vfs_open+0x7c/0x90 [ 202.973273][T30877] path_openat+0x1f6c/0x2888 [ 202.974346][T30877] do_filp_open+0x1bc/0x3cc [ 202.975396][T30877] do_sys_openat2+0x124/0x1b8 [ 202.976416][T30877] __arm64_sys_openat+0x1f0/0x240 [ 202.977444][T30877] invoke_syscall+0x98/0x2b8 [ 202.978470][T30877] el0_svc_common+0x130/0x23c [ 202.979605][T30877] do_el0_svc+0x48/0x58 [ 202.980570][T30877] el0_svc+0x54/0x158 [ 202.981565][T30877] el0t_64_sync_handler+0x84/0xfc [ 202.982789][T30877] el0t_64_sync+0x190/0x194 00:03:22 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:22 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) 00:03:22 executing program 0: socketpair(0x0, 0x2, 0x3, &(0x7f0000000000)) 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) (async, rerun: 64) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) (async) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) (async, rerun: 64) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) (rerun: 64) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:23 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) socketpair(0x29, 0x4, 0x401, &(0x7f0000000000)) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:23 executing program 0: socketpair(0x27, 0x0, 0x3, &(0x7f0000000000)) 00:03:23 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) (async) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) (async) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) (async) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) [ 203.186391][T30919] FAULT_INJECTION: forcing a failure. [ 203.186391][T30919] name failslab, interval 1, probability 0, space 0, times 0 [ 203.190690][T30919] CPU: 1 PID: 30919 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 203.193104][T30919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 203.195361][T30919] Call trace: [ 203.196050][T30919] dump_backtrace+0x1b8/0x1e4 [ 203.197036][T30919] show_stack+0x2c/0x3c [ 203.197986][T30919] dump_stack_lvl+0xd0/0x124 [ 203.199055][T30919] dump_stack+0x1c/0x28 [ 203.200067][T30919] should_fail_ex+0x3b0/0x50c [ 203.201092][T30919] __should_failslab+0xc8/0x128 [ 203.202196][T30919] should_failslab+0x10/0x28 [ 203.203281][T30919] __kmem_cache_alloc_node+0x80/0x368 [ 203.204538][T30919] kmalloc_trace+0x3c/0x88 [ 203.205548][T30919] nci_allocate_device+0xec/0x324 [ 203.206652][T30919] virtual_ncidev_open+0x84/0x1bc [ 203.207754][T30919] misc_open+0x2f0/0x368 [ 203.208741][T30919] chrdev_open+0x3c8/0x4dc [ 203.209820][T30919] do_dentry_open+0x778/0x12b4 [ 203.210969][T30919] vfs_open+0x7c/0x90 [ 203.211852][T30919] path_openat+0x1f6c/0x2888 [ 203.212931][T30919] do_filp_open+0x1bc/0x3cc [ 203.213997][T30919] do_sys_openat2+0x124/0x1b8 [ 203.215069][T30919] __arm64_sys_openat+0x1f0/0x240 [ 203.216143][T30919] invoke_syscall+0x98/0x2b8 [ 203.217171][T30919] el0_svc_common+0x130/0x23c [ 203.218295][T30919] do_el0_svc+0x48/0x58 [ 203.219233][T30919] el0_svc+0x54/0x158 [ 203.220241][T30919] el0t_64_sync_handler+0x84/0xfc [ 203.221446][T30919] el0t_64_sync+0x190/0x194 00:03:23 executing program 0: socketpair(0x27, 0x0, 0x0, &(0x7f0000000000)) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) socket$can_j1939(0x1d, 0x2, 0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) 00:03:23 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 9) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, 0x0) 00:03:23 executing program 0: socketpair(0x27, 0x0, 0x0, 0x0) [ 203.308026][T30949] FAULT_INJECTION: forcing a failure. [ 203.308026][T30949] name failslab, interval 1, probability 0, space 0, times 0 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) socket$can_j1939(0x1d, 0x2, 0x7) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (async) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) (async) 00:03:23 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, 0x0) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xc, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) [ 203.350403][T30949] CPU: 1 PID: 30949 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 203.352524][T30949] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 203.354523][T30949] Call trace: [ 203.355219][T30949] dump_backtrace+0x1b8/0x1e4 [ 203.356403][T30949] show_stack+0x2c/0x3c [ 203.357308][T30949] dump_stack_lvl+0xd0/0x124 [ 203.358402][T30949] dump_stack+0x1c/0x28 [ 203.359306][T30949] should_fail_ex+0x3b0/0x50c [ 203.360404][T30949] __should_failslab+0xc8/0x128 [ 203.361455][T30949] should_failslab+0x10/0x28 [ 203.362551][T30949] __kmem_cache_alloc_node+0x80/0x368 [ 203.363848][T30949] kmalloc_trace+0x3c/0x88 [ 203.364809][T30949] nfc_allocate_device+0x124/0x45c [ 203.366017][T30949] nci_allocate_device+0x1ac/0x324 [ 203.367223][T30949] virtual_ncidev_open+0x84/0x1bc [ 203.368416][T30949] misc_open+0x2f0/0x368 [ 203.369416][T30949] chrdev_open+0x3c8/0x4dc [ 203.370355][T30949] do_dentry_open+0x778/0x12b4 [ 203.371522][T30949] vfs_open+0x7c/0x90 [ 203.372387][T30949] path_openat+0x1f6c/0x2888 [ 203.373415][T30949] do_filp_open+0x1bc/0x3cc [ 203.374473][T30949] do_sys_openat2+0x124/0x1b8 [ 203.375588][T30949] __arm64_sys_openat+0x1f0/0x240 [ 203.376906][T30949] invoke_syscall+0x98/0x2b8 [ 203.377998][T30949] el0_svc_common+0x130/0x23c [ 203.379061][T30949] do_el0_svc+0x48/0x58 [ 203.379985][T30949] el0_svc+0x54/0x158 [ 203.381020][T30949] el0t_64_sync_handler+0x84/0xfc [ 203.382209][T30949] el0t_64_sync+0x190/0x194 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, 0x0) 00:03:23 executing program 0: socketpair(0x27, 0x0, 0x0, 0x0) 00:03:23 executing program 0: socketpair(0x27, 0x0, 0x0, 0x0) 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) (async) socket$can_j1939(0x1d, 0x2, 0x7) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) (async) sendmsg$TIPC_CMD_GET_MEDIA_NAMES(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) 00:03:23 executing program 2: openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:23 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 10) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:23 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, 0x0) 00:03:23 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) [ 203.574128][T30984] FAULT_INJECTION: forcing a failure. [ 203.574128][T30984] name failslab, interval 1, probability 0, space 0, times 0 [ 203.577866][T30984] CPU: 0 PID: 30984 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 203.580083][T30984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 203.582345][T30984] Call trace: [ 203.583072][T30984] dump_backtrace+0x1b8/0x1e4 [ 203.584110][T30984] show_stack+0x2c/0x3c [ 203.585038][T30984] dump_stack_lvl+0xd0/0x124 [ 203.586152][T30984] dump_stack+0x1c/0x28 [ 203.587103][T30984] should_fail_ex+0x3b0/0x50c [ 203.588209][T30984] __should_failslab+0xc8/0x128 [ 203.589401][T30984] should_failslab+0x10/0x28 [ 203.590462][T30984] __kmem_cache_alloc_node+0x80/0x368 [ 203.591659][T30984] __kmalloc_node_track_caller+0xbc/0x1c0 [ 203.593021][T30984] kvasprintf+0x108/0x1dc [ 203.594028][T30984] kvasprintf_const+0xdc/0x230 [ 203.595139][T30984] kobject_set_name_vargs+0xd0/0x1b8 [ 203.596451][T30984] dev_set_name+0xe0/0x12c [ 203.597492][T30984] nfc_allocate_device+0x1a0/0x45c [ 203.598733][T30984] nci_allocate_device+0x1ac/0x324 [ 203.599801][T30984] virtual_ncidev_open+0x84/0x1bc [ 203.600921][T30984] misc_open+0x2f0/0x368 [ 203.601908][T30984] chrdev_open+0x3c8/0x4dc [ 203.602947][T30984] do_dentry_open+0x778/0x12b4 [ 203.604073][T30984] vfs_open+0x7c/0x90 [ 203.605091][T30984] path_openat+0x1f6c/0x2888 [ 203.606183][T30984] do_filp_open+0x1bc/0x3cc [ 203.607201][T30984] do_sys_openat2+0x124/0x1b8 [ 203.608375][T30984] __arm64_sys_openat+0x1f0/0x240 [ 203.609608][T30984] invoke_syscall+0x98/0x2b8 [ 203.610709][T30984] el0_svc_common+0x130/0x23c [ 203.611777][T30984] do_el0_svc+0x48/0x58 [ 203.612779][T30984] el0_svc+0x54/0x158 [ 203.613696][T30984] el0t_64_sync_handler+0x84/0xfc [ 203.614901][T30984] el0t_64_sync+0x190/0x194 00:03:23 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x0, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:23 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) 00:03:23 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, 0x0) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 11) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:23 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) (async) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r1, 0x541b, 0x0) 00:03:23 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, 0x0) 00:03:23 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:23 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r6, 0x80044d76, &(0x7f0000002400)) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r7, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f00000013c0)={{}, r5, 0x6, @unused=[0x3, 0xff, 0xa3, 0x4], @subvolid=0x9}) [ 203.797180][T31021] FAULT_INJECTION: forcing a failure. [ 203.797180][T31021] name failslab, interval 1, probability 0, space 0, times 0 [ 203.810346][T31021] CPU: 1 PID: 31021 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 203.812484][T31021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 203.814809][T31021] Call trace: [ 203.815571][T31021] dump_backtrace+0x1b8/0x1e4 [ 203.816654][T31021] show_stack+0x2c/0x3c [ 203.817504][T31021] dump_stack_lvl+0xd0/0x124 [ 203.818557][T31021] dump_stack+0x1c/0x28 [ 203.819572][T31021] should_fail_ex+0x3b0/0x50c [ 203.820681][T31021] __should_failslab+0xc8/0x128 [ 203.821912][T31021] should_failslab+0x10/0x28 [ 203.822945][T31021] __kmem_cache_alloc_node+0x80/0x368 [ 203.824206][T31021] kmalloc_trace+0x3c/0x88 [ 203.825241][T31021] nci_hci_allocate+0x58/0x248 [ 203.826392][T31021] nci_allocate_device+0x1d4/0x324 [ 203.827475][T31021] virtual_ncidev_open+0x84/0x1bc [ 203.828713][T31021] misc_open+0x2f0/0x368 [ 203.829657][T31021] chrdev_open+0x3c8/0x4dc [ 203.830711][T31021] do_dentry_open+0x778/0x12b4 [ 203.831791][T31021] vfs_open+0x7c/0x90 [ 203.832714][T31021] path_openat+0x1f6c/0x2888 [ 203.833705][T31021] do_filp_open+0x1bc/0x3cc [ 203.834689][T31021] do_sys_openat2+0x124/0x1b8 [ 203.835745][T31021] __arm64_sys_openat+0x1f0/0x240 [ 203.837055][T31021] invoke_syscall+0x98/0x2b8 [ 203.838138][T31021] el0_svc_common+0x130/0x23c [ 203.839194][T31021] do_el0_svc+0x48/0x58 [ 203.840276][T31021] el0_svc+0x54/0x158 [ 203.841169][T31021] el0t_64_sync_handler+0x84/0xfc [ 203.842365][T31021] el0t_64_sync+0x190/0x194 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:23 executing program 2: openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:23 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000002400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, 0x0) sendmsg$L2TP_CMD_TUNNEL_DELETE(r6, &(0x7f0000002700)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002680)={0x2c, 0x0, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_OFFSET={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x44080) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0x0, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 12) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:23 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) (async) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async, rerun: 32) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) (rerun: 32) 00:03:23 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:23 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:23 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000002400)) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, 0x0) 00:03:23 executing program 2: openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) [ 204.017153][T31052] FAULT_INJECTION: forcing a failure. [ 204.017153][T31052] name failslab, interval 1, probability 0, space 0, times 0 [ 204.031677][T31052] CPU: 1 PID: 31052 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 204.033827][T31052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 204.036163][T31052] Call trace: [ 204.036907][T31052] dump_backtrace+0x1b8/0x1e4 [ 204.038026][T31052] show_stack+0x2c/0x3c [ 204.039010][T31052] dump_stack_lvl+0xd0/0x124 [ 204.040096][T31052] dump_stack+0x1c/0x28 [ 204.041067][T31052] should_fail_ex+0x3b0/0x50c [ 204.042171][T31052] __should_failslab+0xc8/0x128 [ 204.043320][T31052] should_failslab+0x10/0x28 [ 204.044472][T31052] __kmem_cache_alloc_node+0x80/0x368 [ 204.045651][T31052] kmalloc_trace+0x3c/0x88 [ 204.046665][T31052] alloc_workqueue+0x15c/0xf70 [ 204.047849][T31052] nci_register_device+0x1ec/0x7c4 [ 204.048976][T31052] virtual_ncidev_open+0x13c/0x1bc [ 204.050145][T31052] misc_open+0x2f0/0x368 [ 204.051146][T31052] chrdev_open+0x3c8/0x4dc [ 204.052230][T31052] do_dentry_open+0x778/0x12b4 [ 204.053240][T31052] vfs_open+0x7c/0x90 [ 204.054186][T31052] path_openat+0x1f6c/0x2888 [ 204.055190][T31052] do_filp_open+0x1bc/0x3cc [ 204.056308][T31052] do_sys_openat2+0x124/0x1b8 [ 204.057412][T31052] __arm64_sys_openat+0x1f0/0x240 [ 204.058608][T31052] invoke_syscall+0x98/0x2b8 [ 204.059667][T31052] el0_svc_common+0x130/0x23c [ 204.060755][T31052] do_el0_svc+0x48/0x58 [ 204.061688][T31052] el0_svc+0x54/0x158 [ 204.062551][T31052] el0t_64_sync_handler+0x84/0xfc [ 204.063780][T31052] el0t_64_sync+0x190/0x194 00:03:24 executing program 2: openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000002400)) socket$nl_generic(0x10, 0x3, 0x10) 00:03:24 executing program 3: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (async) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) (async) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 3: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 13) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) sendmsg$TIPC_CMD_GET_MAX_PORTS(r4, &(0x7f0000002600)={&(0x7f0000002540)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000025c0)={&(0x7f0000002580)={0x1c, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4004000}, 0x20040890) ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:24 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) [ 204.238588][T31084] FAULT_INJECTION: forcing a failure. [ 204.238588][T31084] name failslab, interval 1, probability 0, space 0, times 0 [ 204.247874][T31084] CPU: 1 PID: 31084 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 204.250233][T31084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 204.252464][T31084] Call trace: [ 204.253240][T31084] dump_backtrace+0x1b8/0x1e4 [ 204.254242][T31084] show_stack+0x2c/0x3c [ 204.255209][T31084] dump_stack_lvl+0xd0/0x124 [ 204.256340][T31084] dump_stack+0x1c/0x28 [ 204.257260][T31084] should_fail_ex+0x3b0/0x50c [ 204.258312][T31084] __should_failslab+0xc8/0x128 [ 204.259500][T31084] should_failslab+0x10/0x28 [ 204.260538][T31084] __kmem_cache_alloc_node+0x80/0x368 [ 204.261794][T31084] kmalloc_trace+0x3c/0x88 [ 204.262835][T31084] alloc_workqueue+0x1c4/0xf70 [ 204.263932][T31084] nci_register_device+0x1ec/0x7c4 [ 204.265029][T31084] virtual_ncidev_open+0x13c/0x1bc [ 204.266209][T31084] misc_open+0x2f0/0x368 [ 204.267166][T31084] chrdev_open+0x3c8/0x4dc [ 204.268241][T31084] do_dentry_open+0x778/0x12b4 [ 204.269366][T31084] vfs_open+0x7c/0x90 [ 204.270254][T31084] path_openat+0x1f6c/0x2888 [ 204.271339][T31084] do_filp_open+0x1bc/0x3cc [ 204.272378][T31084] do_sys_openat2+0x124/0x1b8 [ 204.273455][T31084] __arm64_sys_openat+0x1f0/0x240 [ 204.274661][T31084] invoke_syscall+0x98/0x2b8 [ 204.275671][T31084] el0_svc_common+0x130/0x23c [ 204.276751][T31084] do_el0_svc+0x48/0x58 [ 204.277678][T31084] el0_svc+0x54/0x158 [ 204.278555][T31084] el0t_64_sync_handler+0x84/0xfc [ 204.279687][T31084] el0t_64_sync+0x190/0x194 00:03:24 executing program 3: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 3: openat$mixer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) ioctl$mixer_OSS_GETVERSION(0xffffffffffffffff, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 14) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:24 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) ioctl$mixer_OSS_GETVERSION(0xffffffffffffffff, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, r1, 0x800, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x56}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xdc}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) [ 204.435545][T31116] FAULT_INJECTION: forcing a failure. [ 204.435545][T31116] name failslab, interval 1, probability 0, space 0, times 0 00:03:24 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) [ 204.462097][T31116] CPU: 1 PID: 31116 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 204.464347][T31116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 204.466805][T31116] Call trace: [ 204.467494][T31116] dump_backtrace+0x1b8/0x1e4 [ 204.468580][T31116] show_stack+0x2c/0x3c [ 204.469540][T31116] dump_stack_lvl+0xd0/0x124 [ 204.470623][T31116] dump_stack+0x1c/0x28 [ 204.471532][T31116] should_fail_ex+0x3b0/0x50c [ 204.472469][T31116] __should_failslab+0xc8/0x128 [ 204.473579][T31116] should_failslab+0x10/0x28 [ 204.474612][T31116] __kmem_cache_alloc_node+0x80/0x368 [ 204.475767][T31116] __kmalloc_node_track_caller+0xbc/0x1c0 [ 204.477178][T31116] kvasprintf+0x108/0x1dc [ 204.478104][T31116] kasprintf+0xe0/0x12c [ 204.479144][T31116] alloc_workqueue+0x448/0xf70 [ 204.480196][T31116] nci_register_device+0x1ec/0x7c4 [ 204.481280][T31116] virtual_ncidev_open+0x13c/0x1bc [ 204.482439][T31116] misc_open+0x2f0/0x368 [ 204.483458][T31116] chrdev_open+0x3c8/0x4dc [ 204.484463][T31116] do_dentry_open+0x778/0x12b4 [ 204.485584][T31116] vfs_open+0x7c/0x90 [ 204.486435][T31116] path_openat+0x1f6c/0x2888 [ 204.487490][T31116] do_filp_open+0x1bc/0x3cc [ 204.488498][T31116] do_sys_openat2+0x124/0x1b8 [ 204.489504][T31116] __arm64_sys_openat+0x1f0/0x240 [ 204.490638][T31116] invoke_syscall+0x98/0x2b8 [ 204.491707][T31116] el0_svc_common+0x130/0x23c [ 204.492901][T31116] do_el0_svc+0x48/0x58 [ 204.493814][T31116] el0_svc+0x54/0x158 [ 204.494690][T31116] el0t_64_sync_handler+0x84/0xfc [ 204.495855][T31116] el0t_64_sync+0x190/0x194 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r3, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r3, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000012c0)={"749bd2c6e4b50a07a59de1ac5e9591a5", r2, r1, {0x6, 0x7d4}, {0x3, 0xfff}, 0x1, [0xffffffffffffffff, 0xe9, 0x8001, 0x73, 0x9, 0x3, 0x8000, 0x800, 0x4, 0xa43, 0x5, 0xfffffffffffffff9, 0x3, 0x6, 0x100, 0x1f]}) ioctl$mixer_OSS_GETVERSION(0xffffffffffffffff, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, r1, 0x800, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x56}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xdc}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) (async) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) (fail_nth: 15) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:03:24 executing program 2: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r2, 0xc0c89425, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r3, 0x80044d76, &(0x7f0000002400)) 00:03:24 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r0, 0xc0c89425, 0x0) (async) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_SERVICE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd4, r1, 0x800, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DAEMON={0x5c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x56}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xdc}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_to_bond\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010100}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000000) (async, rerun: 32) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (rerun: 32) 00:03:24 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x6, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:03:24 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xd, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:03:24 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:03:24 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x54, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xd5}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9c}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r3 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(r3, 0x541b, 0x0) 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r2, 0x80044d76, &(0x7f0000002400)) [ 204.707620][T31166] FAULT_INJECTION: forcing a failure. [ 204.707620][T31166] name failslab, interval 1, probability 0, space 0, times 0 00:03:24 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(r1, &(0x7f0000002500)={&(0x7f0000002440)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000024c0)={&(0x7f0000002740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="010326bd7000fbdbdf250200000008000c01000000006a83387f7a7d60dab0f413ec9cb0b9860e5645e77445c142b5dbe5a5a11cd26b4354e3d883f2e36e3867c6227cd5f73c05e29a810543120b3c7b9e3fd5d08496239ea56b3cce263ab1b60bcf2d099e3fbea19ba032dcf38eca8cba481043f0b4ef562481287a22fd19d26795fd578005d72b76f59af5336d71530e12375323867b077006f48e09d8cd62d4aed6fb1f2c2c157129f8aeea7212140e00"/193], 0x1c}, 0x1, 0x0, 0x0, 0x804}, 0x4) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r2, 0x80044d76, &(0x7f0000002400)) [ 204.722571][T31166] CPU: 0 PID: 31166 Comm: syz-executor.1 Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 204.724781][T31166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 204.727033][T31166] Call trace: [ 204.727787][T31166] dump_backtrace+0x1b8/0x1e4 [ 204.728795][T31166] show_stack+0x2c/0x3c [ 204.729755][T31166] dump_stack_lvl+0xd0/0x124 [ 204.730838][T31166] dump_stack+0x1c/0x28 [ 204.731807][T31166] should_fail_ex+0x3b0/0x50c [ 204.732891][T31166] __should_failslab+0xc8/0x128 [ 204.734046][T31166] should_failslab+0x10/0x28 [ 204.735048][T31166] __kmem_cache_alloc_node+0x80/0x368 [ 204.736307][T31166] __kmalloc+0xb8/0x1b8 [ 204.737274][T31166] apply_wqattrs_prepare+0x114/0x948 [ 204.738477][T31166] apply_workqueue_attrs+0xc4/0x170 [ 204.739674][T31166] alloc_workqueue+0xa08/0xf70 [ 204.740820][T31166] nci_register_device+0x1ec/0x7c4 [ 204.741976][T31166] virtual_ncidev_open+0x13c/0x1bc [ 204.743129][T31166] misc_open+0x2f0/0x368 [ 204.744110][T31166] chrdev_open+0x3c8/0x4dc [ 204.745138][T31166] do_dentry_open+0x778/0x12b4 [ 204.746244][T31166] vfs_open+0x7c/0x90 [ 204.747074][T31166] path_openat+0x1f6c/0x2888 [ 204.748168][T31166] do_filp_open+0x1bc/0x3cc [ 204.749161][T31166] do_sys_openat2+0x124/0x1b8 [ 204.750205][T31166] __arm64_sys_openat+0x1f0/0x240 [ 204.751410][T31166] invoke_syscall+0x98/0x2b8 [ 204.752402][T31166] el0_svc_common+0x130/0x23c [ 204.753475][T31166] do_el0_svc+0x48/0x58 [ 204.754541][T31166] el0_svc+0x54/0x158 [ 204.755510][T31166] el0t_64_sync_handler+0x84/0xfc [ 204.756729][T31166] el0t_64_sync+0x190/0x194 00:03:24 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x54, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xd5}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9c}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) r3 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(r3, 0x541b, 0x0) 00:03:24 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xd, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) [ 248.818268][ T2223] ieee802154 phy0 wpan0: encryption failed: -22 [ 248.819778][ T2223] ieee802154 phy1 wpan1: encryption failed: -22 00:04:19 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:04:19 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r2, 0x80044d76, &(0x7f0000002400)) 00:04:19 executing program 3: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001600)='/proc/asound/seq/clients\x00', 0x0, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r0, 0x84009422, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r1, 0xc0c89425, 0x0) (async) r2 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x54, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @initdev={0xac, 0x1e, 0x1, 0x0}}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xd5}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast1}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x9c}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) r3 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_TIOCINQ(r3, 0x541b, 0x0) 00:04:19 executing program 1: read$qrtrtun(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0x8, &(0x7f0000001280)=@raw=[@map_val={0x18, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @tail_call], 0x0, 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001380), 0x10}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, 0x0, &(0x7f00000020c0)) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), 0xffffffffffffffff) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 00:04:19 executing program 4: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xe, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @func={0x85, 0x0, 0x1, 0x0, 0x6}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001ec0)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x5}, 0x48) getpeername$packet(r4, &(0x7f0000002080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000020c0)=0x14) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002200)={0x11, 0xe, &(0x7f0000001f40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x86e}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r13}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @generic={0x40, 0x5, 0x8, 0x1, 0x3}, @ldst={0x3, 0x2, 0x0, 0x5, 0xa, 0x18, 0x1}]}, &(0x7f0000001fc0)='syzkaller\x00', 0x0, 0x56, &(0x7f0000002000)=""/86, 0x41100, 0x10, '\x00', r14, 0x0, r4, 0x8, &(0x7f0000002100)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000002140)={0x5, 0xa, 0x4ea, 0x2e037047}, 0x10, 0x0, 0x0, 0x8, 0x0, &(0x7f0000002180)=[{0x5, 0x3, 0x1, 0xb}, {0x2, 0x2, 0xb, 0xc}, {0x3, 0x1, 0xa, 0x9}, {0x0, 0x5, 0x8, 0x8}, {0x1, 0x3, 0x8, 0x9}, {0x1, 0x5}, {0x2, 0x4, 0x4, 0x3}, {0x0, 0x2, 0x5, 0xc}], 0x10, 0x3}, 0x90) r15 = syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f00000023c0)={&(0x7f00000022c0), 0xc, &(0x7f0000002380)={&(0x7f0000002340)={0x20, r15, 0x2, 0x70bd2b, 0x25dfdbfb, {}, [@GTPA_TID={0xc, 0x3, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000002440)={0x0, 0x2, 0x8}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000026c0)={{r12}, &(0x7f0000002640), &(0x7f0000002680)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000002780)={{r10}, &(0x7f0000002700), &(0x7f0000002740)=r8}, 0x20) 00:04:19 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:04:19 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r1, 0x80044d76, &(0x7f0000002400)) 00:04:19 executing program 5: read$qrtrtun(0xffffffffffffffff, &(0x7f0000000000)=""/4096, 0x1000) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000001000), 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000010c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001040), &(0x7f0000001080)}, 0x20) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000001240)={0x71e, 0x0}, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x0, 0xe, &(0x7f0000001280)=@raw=[@map_idx_val={0x18, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff}, @map_val={0x18, 0x3, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x80}, @exit, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffff8}, @tail_call, @map_fd={0x18, 0x2, 0x1, 0x0, 0x1}], &(0x7f0000001300)='GPL\x00', 0x1ffe0000, 0x0, 0x0, 0x40f00, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001340)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000001380)={0x0, 0xccd6, 0x4}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000013c0)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x4}, 0x90) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000014c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x3, 0x1}, 0x48) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001540)='/proc/keys\x00', 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x12, 0x8, &(0x7f0000001100)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0xa, 0x0, 0x0, 0x0, 0x8}, @map_idx={0x18, 0x3, 0x5, 0x0, 0x3}], &(0x7f0000001140)='syzkaller\x00', 0x0, 0x1b, &(0x7f0000001180)=""/27, 0x41100, 0x2, '\x00', 0x0, 0x3, 0xffffffffffffffff, 0x8, &(0x7f00000011c0)={0x2, 0x1}, 0x8, 0x10, &(0x7f0000001200)={0x4, 0x5, 0x4, 0x9}, 0x10, r1, r2, 0x1, &(0x7f0000001580)=[0x1, r3, r4], &(0x7f00000015c0)=[{0x3, 0x4, 0x7, 0x6}], 0x10, 0xffff}, 0x90) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000017c0)={@map=r3, 0xc, 0x1, 0x1, &(0x7f00000016c0)=[0x0], 0x1, 0x0, &(0x7f0000001700)=[0x0, 0x0], &(0x7f0000001740)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0], 0x0}, 0x40) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001800)={@map=r3, r2, 0x3, 0xc, 0x0, @link_fd=r4, r7}, 0x20) r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001b40)=@bpf_ext={0x1c, 0x7, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x1}, [@ldst={0x2, 0x1, 0x2, 0xa, 0x4, 0x40, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa12}, @alu={0x4, 0x0, 0x9, 0x7, 0x6, 0x20, 0xfffffffffffffffc}]}, &(0x7f0000001a40)='GPL\x00', 0x60b, 0x0, 0x0, 0x41000, 0x11, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001a80)={0x2, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x1148f, r5, 0x3, &(0x7f0000001ac0)=[r0], &(0x7f0000001b00)=[{0x0, 0x2, 0x0, 0x1}, {0x0, 0x2, 0x0, 0x7}, {0x4, 0x3, 0x10, 0xc}], 0x10, 0x1}, 0x90) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c00)={0x0, 0xeeb4, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001cc0)={{r3, 0xffffffffffffffff}, &(0x7f0000001c40), &(0x7f0000001c80)=r2}, 0x20) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d00)={0x1b, 0x0, 0x0, 0x7fffffff, 0x0, r6, 0x9, '\x00', 0x0, r4, 0x2, 0x1, 0x1}, 0x48) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d80)={0xffffffffffffffff, 0xfe, 0x8}, 0xc) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e00)=@bpf_tracing={0x1a, 0xd, &(0x7f0000001840)=@raw=[@ldst={0x1, 0x1, 0x3, 0x6, 0x2, 0x1, 0x10}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xc2}}, @btf_id={0x18, 0xb, 0x3, 0x0, 0x3}, @cb_func={0x18, 0x7, 0x4, 0x0, 0x5}], &(0x7f00000018c0)='GPL\x00', 0x3ff, 0x73, &(0x7f0000001900)=""/115, 0x41000, 0x32, '\x00', 0x0, 0x17, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x9, 0x5}, 0x8, 0x10, &(0x7f00000019c0)={0x4, 0x10, 0xfffffc00, 0xfff}, 0x10, 0x1bb56, r8, 0x0, &(0x7f0000001dc0)=[r9, r10, r11, r12, r3, r4], 0x0, 0x10, 0x80000000}, 0x90) syz_genetlink_get_family_id$gtp(&(0x7f0000002300), r4) openat$nci(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) 00:04:19 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x5, 0x20000) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) 00:04:19 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_qrtr_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) 00:04:19 executing program 0: ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000000)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(0xffffffffffffffff, 0x50009418, &(0x7f00000002c0)={{}, r0, 0x12, @inherit={0x90, &(0x7f0000000200)={0x1, 0x9, 0x200, 0x1, {0x8, 0x1ee, 0x6, 0xffffffff7fffffff, 0x7}, [0x2, 0x80, 0x2d64, 0x8000000000000001, 0x4, 0x0, 0xf3a3, 0x2a, 0xfffffffffffffffc]}}, @devid}) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f00000023c0), 0x800, 0x0) ioctl$mixer_OSS_GETVERSION(r1, 0x80044d76, &(0x7f0000002400)) 00:04:19 executing program 3: r0 = syz_open_dev$media(&(0x7f0000000000), 0x5, 0x20000) ioctl$MEDIA_IOC_ENUM_LINKS(r0, 0xc0287c02, &(0x7f0000000140)={0x80000000, &(0x7f0000000040), &(0x7f0000000080)}) (async, rerun: 64) ioctl$sock_qrtr_TIOCINQ(0xffffffffffffffff, 0x541b, 0x0) (rerun: 64) [ 310.261541][ T2223] ieee802154 phy0 wpan0: encryption failed: -22 [ 310.262891][ T2223] ieee802154 phy1 wpan1: encryption failed: -22 [ 361.458376][ T29] INFO: task syz-executor.1:31166 blocked for more than 143 seconds. [ 361.465925][ T29] Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 361.467555][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 361.469757][ T29] task:syz-executor.1 state:D stack:0 pid:31166 tgid:31157 ppid:6124 flags:0x0000000d [ 361.471975][ T29] Call trace: [ 361.472667][ T29] __switch_to+0x314/0x560 [ 361.473691][ T29] __schedule+0x1354/0x2360 [ 361.474658][ T29] schedule+0xb8/0x19c [ 361.475642][ T29] schedule_timeout+0xb8/0x348 [ 361.476722][ T29] do_wait_for_common+0x30c/0x468 [ 361.477885][ T29] wait_for_completion+0x48/0x60 [ 361.479105][ T29] kthread_flush_worker+0x214/0x2d4 [ 361.480302][ T29] alloc_workqueue+0xa30/0xf70 [ 361.481460][ T29] nci_register_device+0x1ec/0x7c4 [ 361.482657][ T29] virtual_ncidev_open+0x13c/0x1bc [ 361.483805][ T29] misc_open+0x2f0/0x368 [ 361.484742][ T29] chrdev_open+0x3c8/0x4dc [ 361.485732][ T29] do_dentry_open+0x778/0x12b4 [ 361.486838][ T29] vfs_open+0x7c/0x90 [ 361.487856][ T29] path_openat+0x1f6c/0x2888 [ 361.488850][ T29] do_filp_open+0x1bc/0x3cc [ 361.489859][ T29] do_sys_openat2+0x124/0x1b8 [ 361.490939][ T29] __arm64_sys_openat+0x1f0/0x240 [ 361.492076][ T29] invoke_syscall+0x98/0x2b8 [ 361.493059][ T29] el0_svc_common+0x130/0x23c [ 361.494127][ T29] do_el0_svc+0x48/0x58 [ 361.495007][ T29] el0_svc+0x54/0x158 [ 361.495882][ T29] el0t_64_sync_handler+0x84/0xfc [ 361.496990][ T29] el0t_64_sync+0x190/0x194 [ 361.499004][ T29] INFO: task syz-executor.5:31177 blocked for more than 143 seconds. [ 361.501434][ T29] Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 361.502970][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 361.504941][ T29] task:syz-executor.5 state:D stack:0 pid:31177 tgid:31174 ppid:6123 flags:0x00000005 [ 361.507120][ T29] Call trace: [ 361.507950][ T29] __switch_to+0x314/0x560 [ 361.508944][ T29] __schedule+0x1354/0x2360 [ 361.514616][ T29] schedule+0xb8/0x19c [ 361.515485][ T29] schedule_preempt_disabled+0x18/0x2c [ 361.516678][ T29] __mutex_lock_common+0xbd8/0x21a0 [ 361.517841][ T29] mutex_lock_nested+0x2c/0x38 [ 361.518878][ T29] misc_open+0x6c/0x368 [ 361.519809][ T29] chrdev_open+0x3c8/0x4dc [ 361.520850][ T29] do_dentry_open+0x778/0x12b4 [ 361.521879][ T29] vfs_open+0x7c/0x90 [ 361.522795][ T29] path_openat+0x1f6c/0x2888 [ 361.523815][ T29] do_filp_open+0x1bc/0x3cc [ 361.524866][ T29] do_sys_openat2+0x124/0x1b8 [ 361.525891][ T29] __arm64_sys_openat+0x1f0/0x240 [ 361.527104][ T29] invoke_syscall+0x98/0x2b8 [ 361.533103][ T29] el0_svc_common+0x130/0x23c [ 361.534192][ T29] do_el0_svc+0x48/0x58 [ 361.535130][ T29] el0_svc+0x54/0x158 [ 361.536000][ T29] el0t_64_sync_handler+0x84/0xfc [ 361.537107][ T29] el0t_64_sync+0x190/0x194 [ 361.538127][ T29] INFO: task syz-executor.5:31181 blocked for more than 143 seconds. [ 361.539946][ T29] Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 361.541509][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 361.543406][ T29] task:syz-executor.5 state:D stack:0 pid:31181 tgid:31174 ppid:6123 flags:0x00000005 [ 361.545630][ T29] Call trace: [ 361.546316][ T29] __switch_to+0x314/0x560 [ 361.547257][ T29] __schedule+0x1354/0x2360 [ 361.548394][ T29] schedule+0xb8/0x19c [ 361.549312][ T29] schedule_preempt_disabled+0x18/0x2c [ 361.550591][ T29] __mutex_lock_common+0xbd8/0x21a0 [ 361.551676][ T29] mutex_lock_nested+0x2c/0x38 [ 361.552717][ T29] misc_open+0x6c/0x368 [ 361.553666][ T29] chrdev_open+0x3c8/0x4dc [ 361.554646][ T29] do_dentry_open+0x778/0x12b4 [ 361.555664][ T29] vfs_open+0x7c/0x90 [ 361.556533][ T29] path_openat+0x1f6c/0x2888 [ 361.557576][ T29] do_filp_open+0x1bc/0x3cc [ 361.563571][ T29] do_sys_openat2+0x124/0x1b8 [ 361.564633][ T29] __arm64_sys_openat+0x1f0/0x240 [ 361.565758][ T29] invoke_syscall+0x98/0x2b8 [ 361.566791][ T29] el0_svc_common+0x130/0x23c [ 361.567841][ T29] do_el0_svc+0x48/0x58 [ 361.568837][ T29] el0_svc+0x54/0x158 [ 361.569684][ T29] el0t_64_sync_handler+0x84/0xfc [ 361.570843][ T29] el0t_64_sync+0x190/0x194 [ 361.571877][ T29] [ 361.571877][ T29] Showing all locks held in the system: [ 361.573557][ T29] 1 lock held by khungtaskd/29: [ 361.574582][ T29] #0: ffff80008e6c48c0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 [ 361.576655][ T29] 1 lock held by klogd/5709: [ 361.582782][ T29] 2 locks held by getty/5864: [ 361.583865][ T29] #0: ffff0000d223d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 361.586050][ T29] #1: ffff800094e602f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41c/0x1228 [ 361.588478][ T29] 1 lock held by syz-executor.1/31166: [ 361.589742][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.591663][ T29] 1 lock held by syz-executor.5/31177: [ 361.592865][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.594797][ T29] 1 lock held by syz-executor.5/31181: [ 361.596019][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.598041][ T29] 1 lock held by syz-executor.4/31187: [ 361.599242][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.601134][ T29] 1 lock held by syz-executor.4/31198: [ 361.602930][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.604967][ T29] 1 lock held by syz-executor.5/31212: [ 361.606194][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.608281][ T29] 1 lock held by syz-executor.1/31213: [ 361.609500][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.611418][ T29] 1 lock held by syz-executor.1/31216: [ 361.612619][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.614419][ T29] 1 lock held by syz-executor.5/31217: [ 361.615614][ T29] #0: ffff80008fc13368 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x6c/0x368 [ 361.617485][ T29] [ 361.619103][ T29] ============================================= [ 361.619103][ T29] [ 361.621088][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 361.622761][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.7.0-rc6-syzkaller-gaafe7ad77b91 #0 [ 361.624964][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 [ 361.627188][ T29] Call trace: [ 361.627913][ T29] dump_backtrace+0x1b8/0x1e4 [ 361.628961][ T29] show_stack+0x2c/0x3c [ 361.629910][ T29] dump_stack_lvl+0xd0/0x124 [ 361.630937][ T29] dump_stack+0x1c/0x28 [ 361.631918][ T29] panic+0x30c/0x88c [ 361.632787][ T29] hung_task_panic+0x0/0x2c [ 361.633786][ T29] kthread+0x288/0x310 [ 361.634660][ T29] ret_from_fork+0x10/0x20 [ 361.635692][ T29] SMP: stopping secondary CPUs [ 361.636855][ T29] Kernel Offset: disabled [ 361.637859][ T29] CPU features: 0x0,00000020,7002004a,21017203 [ 361.639252][ T29] Memory Limit: none [ 362.084008][ T29] Rebooting in 86400 seconds..