x100}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x20000000000000}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8810) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x20000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000100)={'syztnl2\x00', r0, 0x29, 0xdc, 0x80, 0x1ff, 0x56, @empty, @mcast2, 0x8000, 0x8000, 0x2, 0x8}}) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000340)={0xa, 0x4}, 0xc) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x2, 0xfffffff9, 0x47, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x1, 0x10, 0x3f, 0x7f}}) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x0, 0xe24, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) (async) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000300)={0xf, 0x8}, 0x10) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x20000000000000}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8810) (async) openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x20000, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000100)={'syztnl2\x00', r0, 0x29, 0xdc, 0x80, 0x1ff, 0x56, @empty, @mcast2, 0x8000, 0x8000, 0x2, 0x8}}) (async) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000340)={0xa, 0x4}, 0xc) (async) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000008000000087e46e170b0e71105911fe083118026713c7c1ce94fe151b427bd30e297f278f02c8f327e022377e216857a34d110da991450cae2ea74b8289cd0f9644addc8f8be35882281e46451"], 0x20}}, 0x0) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01020000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="e7020000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r3) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x3c, r5, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, '802.15.4 MAC\x00'}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}}, 0x0) (async) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x44854}, 0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="0000000000000000000001000000"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14010000", @ANYRES16=r9, @ANYBLOB="0100000000000000000001000000"], 0x14}}, 0x1d) (async) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3b}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x74}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x800) [ 2513.524692] block nbd4: not configured, cannot reconfigure 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="e7020000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:15 executing program 0: ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x2, 0xfffffff9, 0x47, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @loopback, 0x1, 0x10, 0x3f, 0x7f}}) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x34, 0x0, 0xe24, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000300)={0xf, 0x8}, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000440)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x28, 0x0, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x20000000000000}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x8810) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x20000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000180)={'syztnl1\x00', &(0x7f0000000100)={'syztnl2\x00', r0, 0x29, 0xdc, 0x80, 0x1ff, 0x56, @empty, @mcast2, 0x8000, 0x8000, 0x2, 0x8}}) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f0000000340)={0xa, 0x4}, 0xc) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000008000000087e46e170b0e71105911fe083118026713c7c1ce94fe151b427bd30e297f278f02c8f327e022377e216857a34d110da991450cae2ea74b8289cd0f9644addc8f8be35882281e46451"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000008000000087e46e170b0e71105911fe083118026713c7c1ce94fe151b427bd30e297f278f02c8f327e022377e216857a34d110da991450cae2ea74b8289cd0f9644addc8f8be35882281e46451"], 0x20}}, 0x0) (async) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800a582e4", @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r3) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x3c, r5, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, '802.15.4 MAC\x00'}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}}, 0x0) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x44854}, 0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="0000000000000000000001000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14010000", @ANYRES16=r9, @ANYBLOB="0100000000000000000001000000"], 0x14}}, 0x1d) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3b}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x74}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x800) socket$nl_generic(0x10, 0x3, 0x10) (async) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r3) (async) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x3c, r5, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, '802.15.4 MAC\x00'}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}}, 0x0) (async) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x44854}, 0x4) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="0000000000000000000001000000"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14010000", @ANYRES16=r9, @ANYBLOB="0100000000000000000001000000"], 0x14}}, 0x1d) (async) pipe2$watch_queue(&(0x7f0000000140), 0x80) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3b}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x74}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x800) (async) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x7, 0x40, 0xc72c, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x763299466ca2e5ab, 0x40, 0x28, 0x1}}) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1ca4f77e", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fbdbdf250100000005000500000000009b5644a88c32cab24e9a605c51ab90c46183"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_DEV(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x4008000) [ 2513.650553] block nbd4: not configured, cannot reconfigure 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800a582e4", @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000008000000087e46e170b0e71105911fe083118026713c7c1ce94fe151b427bd30e297f278f02c8f327e022377e216857a34d110da991450cae2ea74b8289cd0f9644addc8f8be35882281e46451"], 0x20}}, 0x0) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1ca4f77e", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fbdbdf250100000005000500000000009b5644a88c32cab24e9a605c51ab90c46183"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_DEV(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x4008000) 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) [ 2513.745658] block nbd4: not configured, cannot reconfigure 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x1) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x9, 0x10000) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2800a582e4", @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x7, 0x40, 0xc72c, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x763299466ca2e5ab, 0x40, 0x28, 0x1}}) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1ca4f77e", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fbdbdf250100000005000500000000009b5644a88c32cab24e9a605c51ab90c46183"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_DEV(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x4008000) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1ca4f77e", @ANYRES16=0x0, @ANYBLOB="08002bbd7000fbdbdf250100000005000500000000009b5644a88c32cab24e9a605c51ab90c46183"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x8080) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_LIST_DEV(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x41}, 0x4008000) (async) 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x1) (async) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x9, 0x10000) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x8c, r1, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000041}, 0x80) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x101082, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r2) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x5d22cabff1ca1beb) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000340)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0xffff0cae, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}}}, 0x30) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x48841) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x10, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xf565}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040081}, 0x4004000) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080), 0x4) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) connect$vsock_dgram(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) (async) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x1) (async) syz_open_dev$sndpcmp(&(0x7f0000000080), 0x9, 0x10000) 12:32:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r3, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x10}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5], 0x1c}}, 0x0) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x10, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xf565}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040081}, 0x4004000) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080), 0x4) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x8c, r1, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000041}, 0x80) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x8c, r1, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000041}, 0x80) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x101082, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r2) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x5d22cabff1ca1beb) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000340)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0xffff0cae, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}}}, 0x30) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x48841) (async, rerun: 32) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (rerun: 32) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) connect$vsock_dgram(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) 12:32:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r3, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x10}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5], 0x1c}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r3, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x10}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x44}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5], 0x1c}}, 0x0) (async) 12:32:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x10, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xf565}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040081}, 0x4004000) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x10, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xf565}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040081}, 0x4004000) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080), 0x4) (async) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x8c, r1, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0x300}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000041}, 0x80) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) connect$vsock_dgram(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) (async) connect$vsock_dgram(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @hyper}, 0x10) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) (async) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) (async) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x101082, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r2) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x5d22cabff1ca1beb) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000340)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0xffff0cae, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}}}, 0x30) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x48841) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x101082, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000002c0), r2) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x5d22cabff1ca1beb) (async) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000340)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e20, 0xffff0cae, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1}}}, 0x30) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r4, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x6}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0x1}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x6}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x48841) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:15 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r3, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x10}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x44}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5], 0x1c}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x44, r3, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x10}, @IEEE802154_ATTR_COORD_PAN_ID={0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x44}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wpan1\x00'}) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5], 0x1c}}, 0x0) (async) 12:32:15 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x90b42, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x4, 0x20, 0x16, 0x0, 0x20, @private0, @rand_addr=' \x01\x00', 0x10, 0x20, 0x4, 0x9}}) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0x8c, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xfe2, 0x3, 0x3, 0x80, 0xffffffffffffffff, 0x800, '\x00', r2, 0xffffffffffffffff, 0x2, 0x2, 0x3, 0x9}, 0x48) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) 12:32:15 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710, @host}, 0x10) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan4\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r4, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r4, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r3, 0x8, 0x70bd26, 0x25dfdbbd}, 0x14}, 0x1, 0x0, 0x0, 0x40090c8}, 0x40) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan4\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r4, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r4, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r3, 0x8, 0x70bd26, 0x25dfdbbd}, 0x14}, 0x1, 0x0, 0x0, 0x40090c8}, 0x40) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan4\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r4, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r4, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r3, 0x8, 0x70bd26, 0x25dfdbbd}, 0x14}, 0x1, 0x0, 0x0, 0x40090c8}, 0x40) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = epoll_create1(0x80000) r3 = inotify_init1(0x1000) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000080)={0x2}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x200008c0) 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80110}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r4, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008841}, 0x4000800) 12:32:15 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x90b42, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x4, 0x20, 0x16, 0x0, 0x20, @private0, @rand_addr=' \x01\x00', 0x10, 0x20, 0x4, 0x9}}) (async, rerun: 32) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 32) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0x8c, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xfe2, 0x3, 0x3, 0x80, 0xffffffffffffffff, 0x800, '\x00', r2, 0xffffffffffffffff, 0x2, 0x2, 0x3, 0x9}, 0x48) 12:32:15 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) 12:32:15 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = epoll_create1(0x80000) (async) r3 = inotify_init1(0x1000) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000080)={0x2}) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x200008c0) 12:32:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80110}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r4, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008841}, 0x4000800) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80110}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r4, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008841}, 0x4000800) (async) 12:32:15 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan4\x00'}) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r4, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r4, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x14, r3, 0x8, 0x70bd26, 0x25dfdbbd}, 0x14}, 0x1, 0x0, 0x0, 0x40090c8}, 0x40) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:15 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) 12:32:15 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) 12:32:16 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x90b42, 0x0) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f00000000c0)={'syztnl1\x00', 0x0, 0x4, 0x20, 0x16, 0x0, 0x20, @private0, @rand_addr=' \x01\x00', 0x10, 0x20, 0x4, 0x9}}) (async, rerun: 64) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 64) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0x8c, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@bloom_filter={0x1e, 0xfe2, 0x3, 0x3, 0x80, 0xffffffffffffffff, 0x800, '\x00', r2, 0xffffffffffffffff, 0x2, 0x2, 0x3, 0x9}, 0x48) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = epoll_create1(0x80000) r3 = inotify_init1(0x1000) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000080)={0x2}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x200008c0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) epoll_create1(0x80000) (async) inotify_init1(0x1000) (async) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r3, &(0x7f0000000080)={0x2}) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x200008c0) (async) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x2f, 0xfe, 0x2, 0x0, 0x1, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x1, 0x2, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r1, 0x29, 0x8, 0x0, 0x101, 0x55, @dev={0xfe, 0x80, '\x00', 0x15}, @remote, 0x10, 0x7, 0x10000, 0x8}}) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x232ce946765a40e7, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x64}, 0x1, 0x0, 0x0, 0x10000014}, 0x200400c0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80110}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x5c, r4, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x40}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20008841}, 0x4000800) 12:32:16 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4800) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x4c, r1, 0x0, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x2e}}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x40) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x232ce946765a40e7, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x64}, 0x1, 0x0, 0x0, 0x10000014}, 0x200400c0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:16 executing program 4: connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x301, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xa8000000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x40002) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x2f, 0xfe, 0x2, 0x0, 0x1, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x1, 0x2, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r1, 0x29, 0x8, 0x0, 0x101, 0x55, @dev={0xfe, 0x80, '\x00', 0x15}, @remote, 0x10, 0x7, 0x10000, 0x8}}) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4800) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x4c, r1, 0x0, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x2e}}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), 0xffffffffffffffff) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4800) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x4c, r1, 0x0, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x2e}}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x40) (async) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x44, 0x0, 0x900, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40800) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010081) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300e7cf1e02b986168fb79f8707b86449a0d3f371c971ae99a917b2563fc6ab6e9e97470545d31c9088d19f7ddcb5707cdc6eb4e36096f5", @ANYRES32=r4], 0x1c}}, 0x0) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x232ce946765a40e7, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x64}, 0x1, 0x0, 0x0, 0x10000014}, 0x200400c0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000001c0)={'wpan3\x00'}) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x64, 0x0, 0x232ce946765a40e7, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x1}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x64}, 0x1, 0x0, 0x0, 0x10000014}, 0x200400c0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:16 executing program 4: connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x301, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xa8000000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x40002) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x44, 0x0, 0x900, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40800) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010081) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300e7cf1e02b986168fb79f8707b86449a0d3f371c971ae99a917b2563fc6ab6e9e97470545d31c9088d19f7ddcb5707cdc6eb4e36096f5", @ANYRES32=r4], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x44, 0x0, 0x900, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40800) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010081) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300e7cf1e02b986168fb79f8707b86449a0d3f371c971ae99a917b2563fc6ab6e9e97470545d31c9088d19f7ddcb5707cdc6eb4e36096f5", @ANYRES32=r4], 0x1c}}, 0x0) (async) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x4004810) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000000)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, r2, 0x0, 0x0], &(0x7f0000000280)=[0x9, 0x7, 0x4, 0x56d, 0x2], 0x4}) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x200) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000008120c14e13fe4e5a09962433d5bf2eb5c134eeaecd4dd995e1bbca75ab88001222f2725946965f8f470af19a2d6f63bf807cd2249bca57e9b9b2a156eaf270d3c78b3889af979aba2ec9c936646ed8e2d5df54cf87bec584fcca05e461b15f8fb0dd9273a0620ee92ea02fc954e2c589ac385f382c94f66f95b413a6be3c22a4bc34adff2f06a601471e6147eb82e1568da1655ad81455c69cce9017b0099d543ec0ca8a8b964aa2d52a21bfffb77d47b29b5675461d5d4dbae2cd8afaeba3ebee838d0c813b5d8d7886bad9085195ae5c49cf86f0b84ac984942f17e11e2a6d463f8026d036b0c665e086c3382a7e1f477d2d5c1196f3a8825dafbd6ccf7302db99511a72905bc53a9ec46afe6e0742f5c3", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf250600000005001400bd00000005000d000000000005001300ff0000000c0016000100000000000000060003000300000014000800766972745f776966693000000000000008001100010000000c001600060000000000000006000e00080000000800110000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000040}, 0x401) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r3, 0x300, 0x70bd2b, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4004000}, 0x4800) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async, rerun: 64) sendmsg$L2TP_CMD_SESSION_DELETE(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x4c, r1, 0x0, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x2e}}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x3}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @loopback}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40008c0}, 0x40) (rerun: 64) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r1, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_FRAME_RETRIES={0x5, 0x28, 0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x81}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0xc010}, 0x1) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x2f, 0xfe, 0x2, 0x0, 0x1, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x1, 0x2, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r1, 0x29, 0x8, 0x0, 0x101, 0x55, @dev={0xfe, 0x80, '\x00', 0x15}, @remote, 0x10, 0x7, 0x10000, 0x8}}) (async) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 12:32:16 executing program 4: connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x301, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xa8000000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x40002) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) (async) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, 0x0, 0x301, 0x70bd28, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0xa8000000}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x841}, 0x40002) (async) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x4004810) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000000)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, r2, 0x0, 0x0], &(0x7f0000000280)=[0x9, 0x7, 0x4, 0x56d, 0x2], 0x4}) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x200) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000008120c14e13fe4e5a09962433d5bf2eb5c134eeaecd4dd995e1bbca75ab88001222f2725946965f8f470af19a2d6f63bf807cd2249bca57e9b9b2a156eaf270d3c78b3889af979aba2ec9c936646ed8e2d5df54cf87bec584fcca05e461b15f8fb0dd9273a0620ee92ea02fc954e2c589ac385f382c94f66f95b413a6be3c22a4bc34adff2f06a601471e6147eb82e1568da1655ad81455c69cce9017b0099d543ec0ca8a8b964aa2d52a21bfffb77d47b29b5675461d5d4dbae2cd8afaeba3ebee838d0c813b5d8d7886bad9085195ae5c49cf86f0b84ac984942f17e11e2a6d463f8026d036b0c665e086c3382a7e1f477d2d5c1196f3a8825dafbd6ccf7302db99511a72905bc53a9ec46afe6e0742f5c3", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf250600000005001400bd00000005000d000000000005001300ff0000000c0016000100000000000000060003000300000014000800766972745f776966693000000000000008001100010000000c001600060000000000000006000e00080000000800110000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000040}, 0x401) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x4004810) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, r2, 0x0, 0x0], &(0x7f0000000280)=[0x9, 0x7, 0x4, 0x56d, 0x2], 0x4}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x200) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000008120c14e13fe4e5a09962433d5bf2eb5c134eeaecd4dd995e1bbca75ab88001222f2725946965f8f470af19a2d6f63bf807cd2249bca57e9b9b2a156eaf270d3c78b3889af979aba2ec9c936646ed8e2d5df54cf87bec584fcca05e461b15f8fb0dd9273a0620ee92ea02fc954e2c589ac385f382c94f66f95b413a6be3c22a4bc34adff2f06a601471e6147eb82e1568da1655ad81455c69cce9017b0099d543ec0ca8a8b964aa2d52a21bfffb77d47b29b5675461d5d4dbae2cd8afaeba3ebee838d0c813b5d8d7886bad9085195ae5c49cf86f0b84ac984942f17e11e2a6d463f8026d036b0c665e086c3382a7e1f477d2d5c1196f3a8825dafbd6ccf7302db99511a72905bc53a9ec46afe6e0742f5c3", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf250600000005001400bd00000005000d000000000005001300ff0000000c0016000100000000000000060003000300000014000800766972745f776966693000000000000008001100010000000c001600060000000000000006000e00080000000800110000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000040}, 0x401) (async) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r1, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_FRAME_RETRIES={0x5, 0x28, 0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x81}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0xc010}, 0x1) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x1) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r2, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000000}]}, 0x68}, 0x1, 0x0, 0x0, 0x28004}, 0x4) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x44, 0x0, 0x900, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40800) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010081) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300e7cf1e02b986168fb79f8707b86449a0d3f371c971ae99a917b2563fc6ab6e9e97470545d31c9088d19f7ddcb5707cdc6eb4e36096f5", @ANYRES32=r4], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x44, 0x0, 0x900, 0x70bd2c, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}]}, 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x40800) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x20000000}, 0x20010081) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300e7cf1e02b986168fb79f8707b86449a0d3f371c971ae99a917b2563fc6ab6e9e97470545d31c9088d19f7ddcb5707cdc6eb4e36096f5", @ANYRES32=r4], 0x1c}}, 0x0) (async) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x4004810) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000000)) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, r2, 0x0, 0x0], &(0x7f0000000280)=[0x9, 0x7, 0x4, 0x56d, 0x2], 0x4}) r3 = socket$nl_generic(0x10, 0x3, 0x10) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x200) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000008120c14e13fe4e5a09962433d5bf2eb5c134eeaecd4dd995e1bbca75ab88001222f2725946965f8f470af19a2d6f63bf807cd2249bca57e9b9b2a156eaf270d3c78b3889af979aba2ec9c936646ed8e2d5df54cf87bec584fcca05e461b15f8fb0dd9273a0620ee92ea02fc954e2c589ac385f382c94f66f95b413a6be3c22a4bc34adff2f06a601471e6147eb82e1568da1655ad81455c69cce9017b0099d543ec0ca8a8b964aa2d52a21bfffb77d47b29b5675461d5d4dbae2cd8afaeba3ebee838d0c813b5d8d7886bad9085195ae5c49cf86f0b84ac984942f17e11e2a6d463f8026d036b0c665e086c3382a7e1f477d2d5c1196f3a8825dafbd6ccf7302db99511a72905bc53a9ec46afe6e0742f5c3", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf250600000005001400bd00000005000d000000000005001300ff0000000c0016000100000000000000060003000300000014000800766972745f776966693000000000000008001100010000000c001600060000000000000006000e00080000000800110000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000040}, 0x401) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x4004810) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(r1, 0xc00864c0, &(0x7f0000000000)) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r1, 0xc00864bf, &(0x7f0000000200)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r1, 0xc01864cb, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, r2, 0x0, 0x0], &(0x7f0000000280)=[0x9, 0x7, 0x4, 0x56d, 0x2], 0x4}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000100), 0x200) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r1) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="000000008120c14e13fe4e5a09962433d5bf2eb5c134eeaecd4dd995e1bbca75ab88001222f2725946965f8f470af19a2d6f63bf807cd2249bca57e9b9b2a156eaf270d3c78b3889af979aba2ec9c936646ed8e2d5df54cf87bec584fcca05e461b15f8fb0dd9273a0620ee92ea02fc954e2c589ac385f382c94f66f95b413a6be3c22a4bc34adff2f06a601471e6147eb82e1568da1655ad81455c69cce9017b0099d543ec0ca8a8b964aa2d52a21bfffb77d47b29b5675461d5d4dbae2cd8afaeba3ebee838d0c813b5d8d7886bad9085195ae5c49cf86f0b84ac984942f17e11e2a6d463f8026d036b0c665e086c3382a7e1f477d2d5c1196f3a8825dafbd6ccf7302db99511a72905bc53a9ec46afe6e0742f5c3", @ANYRES16=r4, @ANYBLOB="010029bd7000fcdbdf250600000005001400bd00000005000d000000000005001300ff0000000c0016000100000000000000060003000300000014000800766972745f776966693000000000000008001100010000000c001600060000000000000006000e00080000000800110000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000040}, 0x401) (async) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x1) (async) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r3) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 32) sendmsg$IEEE802154_LLSEC_GETPARAMS(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r2, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000000}]}, 0x68}, 0x1, 0x0, 0x0, 0x28004}, 0x4) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000000), &(0x7f0000000040)=0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) (async) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x24, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x7d}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x1) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) (async, rerun: 32) syz_genetlink_get_family_id$nl802154(&(0x7f0000000340), r3) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}]}, 0x1c}}, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) (rerun: 64) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x68, r2, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000000}]}, 0x68}, 0x1, 0x0, 0x0, 0x28004}, 0x4) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00F', @ANYRES16=r2, @ANYBLOB="00022dbd7000fedbdf250600000008001800ac1414aa140020002001000000000000000000000000000206000e000300000008001700", @ANYRES32=r3, @ANYBLOB="0c000f000000000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x8001) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r2, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r4, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x28}}, 0x40000) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="c6b8140a4c23a8f4c7ba9b6797801bb27e328a92e6f8f47fb46cb489f67525dc2218a8421a6f3abd16e9a41ecf85bedb13e12d71ad1ec969699fe990700af6dba032c9d013fa22fece65b400619ddd211309a1031ad2ec80716af43f464961c0008de2edc0ea288a1437e3d69b49584772bf54dc9f39d6ffac51505b047a1ac7f31250501d9143738af331c5ea18d75bf0498646aa2759ef3416317c4588825220115deb72d448a6564d1d151a3054fa5177a8ff6f2bd9428759e5bb72eb21173922798880cc82495936181b558ba7f0ca72db9c41fea9b2b605b96ba8b31be89b984c65801edd3acb4ae3d042bc6587d7862b6e9a5038b6b8c58259aa604d4d92b47c5bccfd25cef88152ad1700879a00"/282, @ANYRES16, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRESDEC=r0], 0x1c}}, 0x4008000) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r1, 0x20, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_FRAME_RETRIES={0x5, 0x28, 0x5}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x81}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5}]}, 0x40}, 0x1, 0x0, 0x0, 0xc010}, 0x1) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) (async) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) (async) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x66, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, 0x0, 0x0) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00F', @ANYRES16=r2, @ANYBLOB="00022dbd7000fedbdf250600000008001800ac1414aa140020002001000000000000000000000000000206000e000300000008001700", @ANYRES32=r3, @ANYBLOB="0c000f000000000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x8001) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r2, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r4, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x28}}, 0x40000) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="c6b8140a4c23a8f4c7ba9b6797801bb27e328a92e6f8f47fb46cb489f67525dc2218a8421a6f3abd16e9a41ecf85bedb13e12d71ad1ec969699fe990700af6dba032c9d013fa22fece65b400619ddd211309a1031ad2ec80716af43f464961c0008de2edc0ea288a1437e3d69b49584772bf54dc9f39d6ffac51505b047a1ac7f31250501d9143738af331c5ea18d75bf0498646aa2759ef3416317c4588825220115deb72d448a6564d1d151a3054fa5177a8ff6f2bd9428759e5bb72eb21173922798880cc82495936181b558ba7f0ca72db9c41fea9b2b605b96ba8b31be89b984c65801edd3acb4ae3d042bc6587d7862b6e9a5038b6b8c58259aa604d4d92b47c5bccfd25cef88152ad1700879a00"/282, @ANYRES16, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRESDEC=r0], 0x1c}}, 0x4008000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r2, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r4, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x28}}, 0x40000) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="c6b8140a4c23a8f4c7ba9b6797801bb27e328a92e6f8f47fb46cb489f67525dc2218a8421a6f3abd16e9a41ecf85bedb13e12d71ad1ec969699fe990700af6dba032c9d013fa22fece65b400619ddd211309a1031ad2ec80716af43f464961c0008de2edc0ea288a1437e3d69b49584772bf54dc9f39d6ffac51505b047a1ac7f31250501d9143738af331c5ea18d75bf0498646aa2759ef3416317c4588825220115deb72d448a6564d1d151a3054fa5177a8ff6f2bd9428759e5bb72eb21173922798880cc82495936181b558ba7f0ca72db9c41fea9b2b605b96ba8b31be89b984c65801edd3acb4ae3d042bc6587d7862b6e9a5038b6b8c58259aa604d4d92b47c5bccfd25cef88152ad1700879a00"/282, @ANYRES16, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRESDEC=r0], 0x1c}}, 0x4008000) (async) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="049e1700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x111100, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000841}, 0x200c844) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00F', @ANYRES16=r2, @ANYBLOB="00022dbd7000fedbdf250600000008001800ac1414aa140020002001000000000000000000000000000206000e000300000008001700", @ANYRES32=r3, @ANYBLOB="0c000f000000000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x8001) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x1, 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00F', @ANYRES16=r2, @ANYBLOB="00022dbd7000fedbdf250600000008001800ac1414aa140020002001000000000000000000000000000206000e000300000008001700", @ANYRES32=r3, @ANYBLOB="0c000f000000000000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x44080}, 0x8001) (async) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="049e1700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:16 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x111100, 0x0) (async, rerun: 64) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000841}, 0x200c844) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r2, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r4, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}]}, 0x28}}, 0x40000) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="c6b8140a4c23a8f4c7ba9b6797801bb27e328a92e6f8f47fb46cb489f67525dc2218a8421a6f3abd16e9a41ecf85bedb13e12d71ad1ec969699fe990700af6dba032c9d013fa22fece65b400619ddd211309a1031ad2ec80716af43f464961c0008de2edc0ea288a1437e3d69b49584772bf54dc9f39d6ffac51505b047a1ac7f31250501d9143738af331c5ea18d75bf0498646aa2759ef3416317c4588825220115deb72d448a6564d1d151a3054fa5177a8ff6f2bd9428759e5bb72eb21173922798880cc82495936181b558ba7f0ca72db9c41fea9b2b605b96ba8b31be89b984c65801edd3acb4ae3d042bc6587d7862b6e9a5038b6b8c58259aa604d4d92b47c5bccfd25cef88152ad1700879a00"/282, @ANYRES16, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRESDEC=r0], 0x1c}}, 0x4008000) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) 12:32:16 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="049e1700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x6c, r4, 0xfda7c63f7abbf409, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040048) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESDEC, @ANYRES16=r0], 0x1c}}, 0x0) 12:32:16 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, 0x0, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40) 12:32:16 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a1201007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) 12:32:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x6c, r4, 0xfda7c63f7abbf409, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040048) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESDEC, @ANYRES16=r0], 0x1c}}, 0x0) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) (async) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x111100, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x34, r2, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x2}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_L2SPEC_TYPE={0x5, 0x5, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000841}, 0x200c844) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a1201007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) 12:32:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) socket$inet6_udp(0xa, 0x2, 0x0) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async, rerun: 32) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async, rerun: 32) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 64) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) (rerun: 64) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x6c, r4, 0xfda7c63f7abbf409, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x3}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x9}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5, 0x29, 0x1}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfffe}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}]}, 0x6c}, 0x1, 0x0, 0x0, 0x8000}, 0x20040048) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async, rerun: 32) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYRESDEC, @ANYRES16=r0], 0x1c}}, 0x0) (rerun: 32) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="01000700", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a1201007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000218000000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x8000) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000180)}}, 0x18) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r4, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x40) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000218000000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x8000) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r1, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6fea}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xd3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000050}, 0xeafcf79d3c67f141) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB='\x00\x00\x00O\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400007bd47053bd65806ab1de9a0f92feb90b3e0736e700", @ANYRES16=r1, @ANYBLOB="08002abd7000fedbdf25010000000c000900000000000000000005000700160000000c0009000200aaaaaaaaaaaa"], 0x34}, 0x1, 0x0, 0x0, 0x20008800}, 0x2400c0c1) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000ce3fcf697ac0887ca0551ba3526bf8e33bb648ae63dcd7e4a242daaa2c19a825c80f493020a6e6a005ddafa2f637d84afaafc969bbabc50f39c7b2"], 0x28}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x68, r1, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xff}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6efa}, @IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2000c040}, 0x24008001) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r4, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x1f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x840) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="10002cbd7000fddbdf25040000000800010002000000"], 0x1c}}, 0x4008051) 12:32:17 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000180)}}, 0x18) (async, rerun: 64) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r4, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x40) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LIST(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}}, 0x20040800) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00100051a96f7cd72b2e99fff1ecf66fc742977706585211070a479842cc135138cacb70b66d909a390597b26fcf693ca3cc773ab7b2b001a83d2ccf8d50ce0976e13dde02610f2ef3a8c313bfe8a88d3e51a21267f70112228cd4", @ANYRES16=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r4], 0x1c}}, 0x8000) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r1, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6fea}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xd3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000050}, 0xeafcf79d3c67f141) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB='\x00\x00\x00O\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x0) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000040)=ANY=[@ANYBLOB="010000000100000218000000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00./file0\x00']) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x8000) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) 12:32:17 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400007bd47053bd65806ab1de9a0f92feb90b3e0736e700", @ANYRES16=r1, @ANYBLOB="08002abd7000fedbdf25010000000c000900000000000000000005000700160000000c0009000200aaaaaaaaaaaa"], 0x34}, 0x1, 0x0, 0x0, 0x20008800}, 0x2400c0c1) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000ce3fcf697ac0887ca0551ba3526bf8e33bb648ae63dcd7e4a242daaa2c19a825c80f493020a6e6a005ddafa2f637d84afaafc969bbabc50f39c7b2"], 0x28}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x68, r1, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xff}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6efa}, @IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2000c040}, 0x24008001) (async) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r4, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x1f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x840) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="10002cbd7000fddbdf25040000000800010002000000"], 0x1c}}, 0x4008051) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LIST(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}}, 0x20040800) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00100051a96f7cd72b2e99fff1ecf66fc742977706585211070a479842cc135138cacb70b66d909a390597b26fcf693ca3cc773ab7b2b001a83d2ccf8d50ce0976e13dde02610f2ef3a8c313bfe8a88d3e51a21267f70112228cd4", @ANYRES16=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r4], 0x1c}}, 0x8000) 12:32:17 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x0, 0x0, 0x35) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'sit0\x00', 0x0, 0x2f, 0xfe, 0x2, 0x0, 0x1, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x1, 0x2, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6gre0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r1, 0x29, 0x8, 0x0, 0x101, 0x55, @dev={0xfe, 0x80, '\x00', 0x15}, @remote, 0x10, 0x7, 0x10000, 0x8}}) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x4c, r1, 0x200, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x6fea}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0xd3}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_VLAN_ID={0x6, 0xe, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000050}, 0xeafcf79d3c67f141) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB='\x00\x00\x00O\x00\x00\x00\x00\x00\x00\x00'], 0x20}}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400007bd47053bd65806ab1de9a0f92feb90b3e0736e700", @ANYRES16=r1, @ANYBLOB="08002abd7000fedbdf25010000000c000900000000000000000005000700160000000c0009000200aaaaaaaaaaaa"], 0x34}, 0x1, 0x0, 0x0, 0x20008800}, 0x2400c0c1) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000ce3fcf697ac0887ca0551ba3526bf8e33bb648ae63dcd7e4a242daaa2c19a825c80f493020a6e6a005ddafa2f637d84afaafc969bbabc50f39c7b2"], 0x28}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x68, r1, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xff}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6efa}, @IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2000c040}, 0x24008001) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r4, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x1f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x840) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="10002cbd7000fddbdf25040000000800010002000000"], 0x1c}}, 0x4008051) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400007bd47053bd65806ab1de9a0f92feb90b3e0736e700", @ANYRES16=r1, @ANYBLOB="08002abd7000fedbdf25010000000c000900000000000000000005000700160000000c0009000200aaaaaaaaaaaa"], 0x34}, 0x1, 0x0, 0x0, 0x20008800}, 0x2400c0c1) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000ce3fcf697ac0887ca0551ba3526bf8e33bb648ae63dcd7e4a242daaa2c19a825c80f493020a6e6a005ddafa2f637d84afaafc969bbabc50f39c7b2"], 0x28}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r2, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x68, r1, 0x300, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_SHORT_ADDR={0x6}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xff}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6efa}, @IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x2000c040}, 0x24008001) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000200), r2) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r4, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x30, r1, 0x400, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x1f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x840) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="10002cbd7000fddbdf25040000000800010002000000"], 0x1c}}, 0x4008051) (async) 12:32:17 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000040), 0x200, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r3, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000180)}}, 0x18) (async, rerun: 64) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r4, 0x300, 0x70bd25, 0x25dfdbfc, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e22}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x40) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_LIST(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r2, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x1c}}, 0x20040800) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c00100051a96f7cd72b2e99fff1ecf66fc742977706585211070a479842cc135138cacb70b66d909a390597b26fcf693ca3cc773ab7b2b001a83d2ccf8d50ce0976e13dde02610f2ef3a8c313bfe8a88d3e51a21267f70112228cd4", @ANYRES16=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r4], 0x1c}}, 0x8000) 12:32:17 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x10, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e22}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x8}, @L2TP_ATTR_MRU={0x6, 0x1d, 0xf565}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x2}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e21}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}]}, 0x64}, 0x1, 0x0, 0x0, 0x4040081}, 0x4004000) setsockopt$inet6_udp_int(r1, 0x11, 0x1, &(0x7f0000000080), 0x4) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x100000000}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x40010) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x8a}}, 0x0) 12:32:17 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xfffffffffffffd83, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44090}, 0x8000) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x100000000}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x40010) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:17 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xfffffffffffffd83, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44090}, 0x8000) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x8a}}, 0x0) 12:32:17 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x8000, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:17 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x2b, 0xc2, 0x4e, 0xf3, 0xb041d7d314a616ae, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x10, 0x10, 0x6, 0x9}}) 12:32:17 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x100000000}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x40010) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x34, 0x0, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x100000000}]}, 0x34}, 0x1, 0x0, 0x0, 0x11}, 0x40010) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:17 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r2, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x8a}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x8a}}, 0x0) (async) 12:32:17 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r2) sendmsg$IEEE802154_LLSEC_ADD_DEV(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xfffffffffffffd83, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r3, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44090}, 0x8000) (async, rerun: 64) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x24, r1, 0x1, 0x0, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x80}]}, 0x24}}, 0x0) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:17 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x2b, 0xc2, 0x4e, 0xf3, 0xb041d7d314a616ae, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x10, 0x10, 0x6, 0x9}}) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x24, r1, 0x1, 0x0, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x80}]}, 0x24}}, 0x0) 12:32:17 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r3) sendmsg$NBD_CMD_RECONFIGURE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)={0x3c, r5, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, '802.15.4 MAC\x00'}, @NBD_ATTR_SOCKETS={0xc, 0x7, 0x0, 0x1, [{0x8}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x3c}}, 0x0) sendmsg$NBD_CMD_STATUS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x38, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x5}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0xffffffff}]}, 0x38}, 0x1, 0x0, 0x0, 0x44854}, 0x4) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="0000000000000000000001000000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14010000", @ANYRES16=r9, @ANYBLOB="0100000000000000000001000000"], 0x14}}, 0x1d) pipe2$watch_queue(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) sendmsg$L2TP_CMD_TUNNEL_GET(r10, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r7, 0x1, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x3b}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x74}]}, 0x2c}, 0x1, 0x0, 0x0, 0x2404c044}, 0x800) 12:32:17 executing program 5: clock_settime(0x4, &(0x7f0000000000)={0x0, 0x989680}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)={0x24, r1, 0x1, 0x0, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_CSMA_MIN_BE={0x5, 0x26, 0x80}]}, 0x24}}, 0x0) 12:32:17 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'syztnl0\x00', 0x0, 0x2b, 0xc2, 0x4e, 0xf3, 0xb041d7d314a616ae, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast1, 0x10, 0x10, 0x6, 0x9}}) [ 2516.353408] nbd: couldn't find a device at index 1 12:32:17 executing program 5: clock_settime(0x4, &(0x7f0000000000)={0x0, 0x989680}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:17 executing program 3: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:17 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01060000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x48, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0xc0}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4000040) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1b}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x3}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x9}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x17}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x4000) 12:32:17 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f00000002c0)={0x7, 0x8, 0xfa00, {r1}}, 0x10) socket$inet6_dccp(0xa, 0x6, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$inet6(0xa, 0x0, 0x7) setsockopt$inet6_udp_int(r2, 0x11, 0x66, 0x0, 0xffffffc3) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) write$RDMA_USER_CM_CMD_ACCEPT(r3, &(0x7f0000000000)={0x8, 0x120, 0xfa00, {0x3, {0x4, 0xfffffff5, "39d3714ead1ecc4655f5bbd96ba90c97c21bb782f5f8196de2e573526247fcac5ae39e5ed48d075d319b30738d519775caab9e5798f24f35c3ef5e3d50ab21a279d2d4ec7d6e6cf6727d63df2fbacf9fc4d365dfbd0326a51d3d00b528165b889fa5169d3a00d315fc09d7bc1dd681b6ead464868cbd161ab0c82fd9af5f16fad41940524652a43895bd9845206ea166b52cc362fde54b3f56e6d44a15656726df71bcb41a0564acce3b13a88c438296ff4dd2c8bc5c906eba6b63fc88df478dd7fd95e8d53dc5dcf0c34857a5b1e93fe0d74a0b9ee869667c987fd37838caf2b2a303313a93ef558c84b55c83c9fe3e0d71e9006b22256cefbe3b2284169685", 0x1, 0x9, 0x9, 0x6c, 0x1, 0xd8, 0xa5}}}, 0x128) 12:32:17 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@empty}, &(0x7f00000000c0)=0x14) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) setsockopt$inet6_udp_int(r2, 0x11, 0x2, &(0x7f0000000140)=0x8, 0x4) 12:32:18 executing program 5: clock_settime(0x4, &(0x7f0000000000)={0x0, 0x989680}) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000807000008"], 0x20}}, 0x0) 12:32:18 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01060000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x48, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0xc0}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4000040) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1b}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x3}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x9}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x17}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x4000) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01060000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x48, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0xc0}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4000040) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1b}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x3}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x9}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x17}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x4000) (async) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@empty}, &(0x7f00000000c0)=0x14) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) setsockopt$inet6_udp_int(r2, 0x11, 0x2, &(0x7f0000000140)=0x8, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@empty}, &(0x7f00000000c0)=0x14) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) setsockopt$inet6_udp_int(r2, 0x11, 0x2, &(0x7f0000000140)=0x8, 0x4) (async) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400a004}, 0x4840) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01090000000000000000000000000000000275e0594532a967fcf15740afdb0fa9ce8fce9157e0310eef3e", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000807000008"], 0x20}}, 0x0) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@empty}, &(0x7f00000000c0)=0x14) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) setsockopt$inet6_udp_int(r2, 0x11, 0x2, &(0x7f0000000140)=0x8, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@empty}, &(0x7f00000000c0)=0x14) (async) pipe2$watch_queue(&(0x7f0000000080), 0x80) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000100)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) setsockopt$inet6_udp_int(r2, 0x11, 0x2, &(0x7f0000000140)=0x8, 0x4) (async) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:18 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, r1, 0x800, 0x70bd25, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xff}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0x2}]}, 0x4c}}, 0x8800) connect$vsock_dgram(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @host}, 0x10) 12:32:18 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01060000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000200), r2) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000240)={0x48, r4, 0x400, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0xc0}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0xff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x1}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4000040) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r1, 0x400, 0x70bd25, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x1b}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x1}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x3}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x1f}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x9}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x17}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}]}, 0x68}, 0x1, 0x0, 0x0, 0x24004004}, 0x4000) 12:32:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 64) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400a004}, 0x4840) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01090000000000000000000000000000000275e0594532a967fcf15740afdb0fa9ce8fce9157e0310eef3e", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000807000008"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000807000008"], 0x20}}, 0x0) (async) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008", @ANYRESDEC=r2, @ANYRES16=r3, @ANYRES16=r4], 0x20}}, 0x0) 12:32:18 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f0000000140)={'ip6tnl0\x00', 0x0, 0x2f, 0x2, 0x1f, 0x9, 0x10, @ipv4={'\x00', '\xff\xff', @multicast2}, @ipv4={'\x00', '\xff\xff', @remote}, 0x8, 0x700, 0x0, 0x4}}) r3 = geteuid() sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x400c080}, 0x10054) sendmsg$nl_xfrm(r1, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000200)={&(0x7f00000004c0)=@polexpire={0x188, 0x1b, 0x100, 0x70bd2d, 0x25dfdbfe, {{{@in6=@loopback, @in=@empty, 0x4e21, 0x0, 0x4e21, 0x0, 0x2, 0xa0, 0x20, 0x2f, r2, r3}, {0x6b4, 0x2, 0x80000000, 0x8, 0x3000000000, 0x7ff, 0xffffffff, 0x11ec}, {0x8, 0x5, 0x9, 0x2}, 0xffff, 0x6e6bb6, 0x0, 0x0, 0x3, 0x1}, 0x3}, [@lifetime_val={0x24, 0x9, {0x1, 0x3, 0x10000, 0x1}}, @migrate={0x9c, 0x11, [{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6=@remote, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x33, 0x2, 0x0, 0x3507, 0x0, 0xa}, {@in=@dev={0xac, 0x14, 0x14, 0xf}, @in6=@dev={0xfe, 0x80, '\x00', 0x10}, @in=@loopback, @in6=@loopback, 0x33, 0x17c554c475da04bd, 0x0, 0x3504, 0xa, 0x2}]}, @tfcpad={0x8, 0x16, 0xffff}]}, 0x188}, 0x1, 0x0, 0x0, 0x1}, 0x8000) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000051e1a3c4e69c981dfb18b01c0f94d9efafb7348bc5f6bbcc6d64155eff37a298405bbd", @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x0, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:18 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008", @ANYRESDEC=r2, @ANYRES16=r3, @ANYRES16=r4], 0x20}}, 0x0) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x0, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:18 executing program 1: sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="020026bd7000fbdbdf050200382005004bf71e9b00000800020002000000080001000000000008000100010000000800020002000000e562ed1361bbafc0b10800010001000000"], 0x44}, 0x1, 0x0, 0x0, 0x60000050}, 0xc0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00000010d414ad3fb27b8ce0bca571c0a3a9309490abe2b8c14181f2b581cbff7ba5f8eb809d6e7bab5b64ed37d0dbec9054be2bc94353a4a29783ea6025b4ccd5a7662597d1c27f00"/101, @ANYRES16=r2, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:18 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 64) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) (async, rerun: 32) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r1, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400a004}, 0x4840) (async, rerun: 32) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01090000000000000000000000000000000275e0594532a967fcf15740afdb0fa9ce8fce9157e0310eef3e", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000040)) 12:32:18 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008", @ANYRESDEC=r2, @ANYRES16=r3, @ANYRES16=r4], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYRESHEX=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008", @ANYRESDEC=r2, @ANYRES16=r3, @ANYRES16=r4], 0x20}}, 0x0) (async) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x0, 0x7f, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:18 executing program 1: sendmsg$NLBL_CALIPSO_C_LISTALL(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="020026bd7000fbdbdf050200382005004bf71e9b00000800020002000000080001000000000008000100010000000800020002000000e562ed1361bbafc0b10800010001000000"], 0x44}, 0x1, 0x0, 0x0, 0x60000050}, 0xc0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r1) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00000010d414ad3fb27b8ce0bca571c0a3a9309490abe2b8c14181f2b581cbff7ba5f8eb809d6e7bab5b64ed37d0dbec9054be2bc94353a4a29783ea6025b4ccd5a7662597d1c27f00"/101, @ANYRES16=r2, @ANYBLOB="01000000000000000000230000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmstat\x00', 0x0, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:18 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:18 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x713, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:18 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r3, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r5, 0x200, 0x70bd2b, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x40000c0) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r7) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r8, 0x1, 0x8, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r3, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0xfffffe28, r6, 0x10, 0x70bd2b, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x0, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000001}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x804) 12:32:18 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000200), 0x11082) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8080) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x82c, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x3c}}, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r6, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44100020}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r7, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004042}, 0x4004004) 12:32:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmstat\x00', 0x0, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r3) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x2, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000180)={[{0x6, 0x9, 0xff, 0x5, 0x4, 0x9, 0x3f, 0x0, 0x1f, 0xf, 0x7f, 0xff, 0x7}, {0x2, 0xae5, 0x3, 0x5, 0x9, 0x5, 0x0, 0x5, 0x0, 0x3, 0x4, 0x7, 0x7ef}, {0x5, 0x8, 0x1, 0x3f, 0x1, 0x7, 0x81, 0x0, 0x80, 0x0, 0x6, 0x81, 0x8}], 0x4}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000b4000023b5a0742a35a930f66be0ce677e0000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:19 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000200), 0x11082) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8080) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x82c, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x3c}}, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r6, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44100020}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r7, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004042}, 0x4004004) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000200), 0x11082) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8080) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x82c, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x3c}}, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r6, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) (async) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44100020}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r7, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004042}, 0x4004004) (async) 12:32:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/vmstat\x00', 0x0, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:19 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000580)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x6c, r3, 0x8, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r2}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20008000}, 0x8811) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), r0) sendmsg$NLBL_CALIPSO_C_ADD(r5, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x3c, r6, 0x400, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x894) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000400)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010028bd7000fcdbdf251000000008000300", @ANYRES32=r7, @ANYBLOB="05001000810000000500110006000000"], 0x34}}, 0x1) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a00000080003006c3828855b71e5259c351937da558f19b2e2aabc2bb86e00f38a37639e4d223b9a9b6f31ed51f940f7b61d56958d81e554a7cba5db3188b0146ddfc8afaa8aba000000000000000000000000486b53a77738177e3b12315cd7503528eecb0d8c4aec367c21304885942ceb38473f4aedb00b2bb20801ca067cafcc87afb88029c32cd0451fdd675d32286d7b537b8a6cdffb89b40eca2b664906fd181703ce8f3cd3cfd081f05cc08b7528f9b0a62b51cdc6ad51629972ebb6bf5bea8c44cee6ddecf8b34dfc79d245f84ab7eeb84e9803be6394aa2177dcfb74a27ac1f56fcecbbd49cdd5faa3f353fa2533ee916a7def9d8258ac1b498f6f926bd87ba6e5e41d0361ff9126e49a1a8c907a31253996b05397d33331484f6fb4b20b3184fd2b98c678309bc4693c9f8e40c46338d3a7be479623a8d391fecc361bac9c9b39cd6b41f5286f1fce81a51c367163", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000180)={[{0x6, 0x9, 0xff, 0x5, 0x4, 0x9, 0x3f, 0x0, 0x1f, 0xf, 0x7f, 0xff, 0x7}, {0x2, 0xae5, 0x3, 0x5, 0x9, 0x5, 0x0, 0x5, 0x0, 0x3, 0x4, 0x7, 0x7ef}, {0x5, 0x8, 0x1, 0x3f, 0x1, 0x7, 0x81, 0x0, 0x80, 0x0, 0x6, 0x81, 0x8}], 0x4}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000b4000023b5a0742a35a930f66be0ce677e0000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x0, 0x8, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) [ 2517.590866] nla_parse: 65 callbacks suppressed [ 2517.590872] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 12:32:19 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20004) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000000) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x0, 0x0, 0x48, 0x64, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:19 executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000180)={[{0x6, 0x9, 0xff, 0x5, 0x4, 0x9, 0x3f, 0x0, 0x1f, 0xf, 0x7f, 0xff, 0x7}, {0x2, 0xae5, 0x3, 0x5, 0x9, 0x5, 0x0, 0x5, 0x0, 0x3, 0x4, 0x7, 0x7ef}, {0x5, 0x8, 0x1, 0x3f, 0x1, 0x7, 0x81, 0x0, 0x80, 0x0, 0x6, 0x81, 0x8}], 0x4}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000b4000023b5a0742a35a930f66be0ce677e0000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000180)={[{0x6, 0x9, 0xff, 0x5, 0x4, 0x9, 0x3f, 0x0, 0x1f, 0xf, 0x7f, 0xff, 0x7}, {0x2, 0xae5, 0x3, 0x5, 0x9, 0x5, 0x0, 0x5, 0x0, 0x3, 0x4, 0x7, 0x7ef}, {0x5, 0x8, 0x1, 0x3f, 0x1, 0x7, 0x81, 0x0, 0x80, 0x0, 0x6, 0x81, 0x8}], 0x4}) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000b4000023b5a0742a35a930f66be0ce677e0000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), r1) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), r2) (async) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000180)={[{0x6, 0x9, 0xff, 0x5, 0x4, 0x9, 0x3f, 0x0, 0x1f, 0xf, 0x7f, 0xff, 0x7}, {0x2, 0xae5, 0x3, 0x5, 0x9, 0x5, 0x0, 0x5, 0x0, 0x3, 0x4, 0x7, 0x7ef}, {0x5, 0x8, 0x1, 0x3f, 0x1, 0x7, 0x81, 0x0, 0x80, 0x0, 0x6, 0x81, 0x8}], 0x4}) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nbd(&(0x7f0000000040), r4) (async) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000b4000023b5a0742a35a930f66be0ce677e0000000a0001007770616e310000000800240000000000"], 0x28}}, 0x0) (async) 12:32:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r3) 12:32:19 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000200), 0x11082) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8080) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x82c, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x3c}}, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r6, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44100020}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r7, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004042}, 0x4004004) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000200), 0x11082) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x64, r1, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@L2TP_ATTR_FD={0x8, 0x17, @l2tp=r2}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x5}, @L2TP_ATTR_PEER_COOKIE={0xc}]}, 0x64}, 0x1, 0x0, 0x0, 0x1}, 0x8080) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x0, 0x82c, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}]}, 0x3c}}, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r5, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r6, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) (async) ioctl$sock_SIOCGIFINDEX_802154(r8, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r10}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r5, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x44100020}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r7, 0x200, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r10}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004042}, 0x4004004) (async) [ 2517.659609] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0xfa, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:19 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20004) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000000) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000000), 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x10) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20004) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000000) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) [ 2517.755304] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. 12:32:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000000), r3) (rerun: 32) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r4, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000180), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, 'NLBL_CALIPSO\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x40810) sendmsg$IEEE802154_LIST_IFACE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x4000045) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) [ 2517.795480] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.1'. 12:32:19 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x4008801) 12:32:19 executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20004) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000000) r10 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000000), 0x4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r2, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan3\x00'}) (async) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r3, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}]}, 0x24}}, 0x10) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8, 0x2f, 0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x20004) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r8) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r9, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x34, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x24000000) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r10, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x12, 0x4, 0x0, 0x0, 0x48, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}, @lsrr={0x83, 0x23, 0x51, [@multicast1, @private=0xa010100, @private=0xa010102, @broadcast, @rand_addr=0x64010101, @multicast2, @empty, @multicast2]}]}}}}}) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000180), r1) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, 'NLBL_CALIPSO\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x40810) sendmsg$IEEE802154_LIST_IFACE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x4000045) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r4, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x4008801) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000180), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, 'NLBL_CALIPSO\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x40810) sendmsg$IEEE802154_LIST_IFACE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x4000045) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000180), r1) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BACKEND_IDENTIFIER={0x11, 0xa, 'NLBL_CALIPSO\x00'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8}, 0x40810) (async) sendmsg$IEEE802154_LIST_IFACE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8001}, 0x4000045) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r4, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) 12:32:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r7, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x14, r5, 0x10, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}}, 0x4000880) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, 0x0, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x4081) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)={0x1c, 0x0, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="a1db6dedc449c36b0000aa272c1ec010dc27bfecee8ca0b7005a43223fc742077a112a1a94880366bea589072cb77f8039300e32e9ef555bb20ed881d8d163384fa1b7ad689f8cf1d3575f06d9defa13261cf701970732fbe60a33882e7f89d6ec3fd719b038a829f2e244596c7b48214746dd5b8db6f94b3b3a1e26bc3ed8dcc2ea582e660153e40e1eab0af29d1547fc95c95da3cf8e9aa72420fd6cc9963231e9c2be287522370c7a552ce5f09399c579d72f41bfd2bdf76765ade45b847ae0aee119150c349a23eb576421ead7ac6cc9fd2f60c7b174bf9d085c74f20376b1635b11f1cd8cc93cf213a56963d5af1724bdec8a9bfff1f5542c4b585a7e11f816765ae768ce079dfaf592e50a33bfcd", @ANYRES16=0x0, @ANYBLOB="02002dbd7000fcdbdf25250000000c0005000203aaaaaaaaaaaa08000200", @ANYRES32=r6, @ANYBLOB="08000200", @ANYRES32=r11, @ANYBLOB="0c002d000200aaaaaaaaaaaa"], 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xf, 0xc9, [@broadcast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}]}]}}}}}) 12:32:19 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x4008801) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYRESOCT=r0, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x4008801) (async) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r3, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r7, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x14, r5, 0x10, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}}, 0x4000880) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), 0xffffffffffffffff) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 64) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, 0x0, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x4081) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 64) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)={0x1c, 0x0, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="a1db6dedc449c36b0000aa272c1ec010dc27bfecee8ca0b7005a43223fc742077a112a1a94880366bea589072cb77f8039300e32e9ef555bb20ed881d8d163384fa1b7ad689f8cf1d3575f06d9defa13261cf701970732fbe60a33882e7f89d6ec3fd719b038a829f2e244596c7b48214746dd5b8db6f94b3b3a1e26bc3ed8dcc2ea582e660153e40e1eab0af29d1547fc95c95da3cf8e9aa72420fd6cc9963231e9c2be287522370c7a552ce5f09399c579d72f41bfd2bdf76765ade45b847ae0aee119150c349a23eb576421ead7ac6cc9fd2f60c7b174bf9d085c74f20376b1635b11f1cd8cc93cf213a56963d5af1724bdec8a9bfff1f5542c4b585a7e11f816765ae768ce079dfaf592e50a33bfcd", @ANYRES16=0x0, @ANYBLOB="02002dbd7000fcdbdf25250000000c0005000203aaaaaaaaaaaa08000200", @ANYRES32=r6, @ANYBLOB="08000200", @ANYRES32=r11, @ANYBLOB="0c002d000200aaaaaaaaaaaa"], 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) 12:32:19 executing program 3: inotify_init1(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x850) 12:32:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) 12:32:19 executing program 4: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) syz_open_dev$amidi(&(0x7f0000000200), 0x344, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev}, &(0x7f0000000080)=0x14) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8, 0x2b, 0x3fd}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x8001}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x4}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4044) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0xb, &(0x7f0000000000), 0x4) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:19 executing program 3: inotify_init1(0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x850) inotify_init1(0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x850) (async) 12:32:19 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (fail_nth: 1) 12:32:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x81}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x20008000) 12:32:19 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:19 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x81}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x20008000) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r4) (async) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r7, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x14, r5, 0x10, 0x70bd2b, 0x25dfdbfc, {}, ["", "", "", "", "", ""]}, 0x14}}, 0x4000880) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r5, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x1c}}, 0x0) (async) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r8, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r9}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_SET_ACKREQ_DEFAULT(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x5c, 0x0, 0x800, 0x70bd25, 0x25dfdbfc, {}, [@NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5}, @NL802154_ATTR_ACKREQ_DEFAULT={0x5, 0x1a, 0x1}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x4081) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) (async) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000500)={0x1c, 0x0, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="a1db6dedc449c36b0000aa272c1ec010dc27bfecee8ca0b7005a43223fc742077a112a1a94880366bea589072cb77f8039300e32e9ef555bb20ed881d8d163384fa1b7ad689f8cf1d3575f06d9defa13261cf701970732fbe60a33882e7f89d6ec3fd719b038a829f2e244596c7b48214746dd5b8db6f94b3b3a1e26bc3ed8dcc2ea582e660153e40e1eab0af29d1547fc95c95da3cf8e9aa72420fd6cc9963231e9c2be287522370c7a552ce5f09399c579d72f41bfd2bdf76765ade45b847ae0aee119150c349a23eb576421ead7ac6cc9fd2f60c7b174bf9d085c74f20376b1635b11f1cd8cc93cf213a56963d5af1724bdec8a9bfff1f5542c4b585a7e11f816765ae768ce079dfaf592e50a33bfcd", @ANYRES16=0x0, @ANYBLOB="02002dbd7000fcdbdf25250000000c0005000203aaaaaaaaaaaa08000200", @ANYRES32=r6, @ANYBLOB="08000200", @ANYRES32=r11, @ANYBLOB="0c002d000200aaaaaaaaaaaa"], 0x3c}, 0x1, 0x0, 0x0, 0x4004}, 0x10) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x302, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'gre0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000044) 12:32:20 executing program 3: inotify_init1(0x0) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, 0x0, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}]}, 0x24}, 0x1, 0x0, 0x0, 0x40804}, 0x850) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$VHOST_SET_VRING_ENDIAN(r2, 0x4008af13, &(0x7f0000000280)={0x0, 0x7}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x81}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x20008000) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {}, [@L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @mcast1}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x1}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x81}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x20008000) (async) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x302, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'gre0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000044) 12:32:20 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) socketpair(0x1, 0xa, 0x20000, &(0x7f0000000140)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r3) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x4000) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffcfa386c6b23cff00ab47834253d0eda1a05f3fc49db7b9ba70d4969d9245199fa547775960085c52955e14d917", @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="010034000020009b62e628a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4008840}, 0x24004860) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x60, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xf4}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xfb}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x5) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async, rerun: 64) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x302, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x9, 0xa, 'gre0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x84}, 0x20000044) 12:32:20 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 64) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socketpair(0x1, 0xa, 0x20000, &(0x7f0000000140)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async, rerun: 32) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 32) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r3) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x4000) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffcfa386c6b23cff00ab47834253d0eda1a05f3fc49db7b9ba70d4969d9245199fa547775960085c52955e14d917", @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x222000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x2, 0x1f, 0x91a, 0x61, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7800, 0x10, 0x4, 0xffff9f96}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="0100000000000000000001004000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x24}}, 0x20000000) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, 0x0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xac, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x98, 0x20, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x30, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x2c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x20000000) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000005c0), 0x802, 0x0) ioctl$KVM_GET_API_VERSION(r6, 0xae00, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r5, &(0x7f00000003c0)={0x8, 0x120, 0xfa00, {0x0, {0x200, 0x0, "d91241613fb76b36f55bc438e3fa76544b55439593944f1f80f3bab74464a1b400a14d4570157ae20d87c479ebef4ad6b9faf4a49ac6714a75049d038c6fcdcf08a65e5d00000000c0330816797240d00e77bd07f3baa0200555bce3e64dc011ae1aadc831f1183b2cd6f50f4a74dd4730e5001c7eb082232496c21ff2399b4730f98029ab5ee432c22fcd3c13547928de0a07291276ae78c901a007f903af0b414687f66907b1624d8d46f3859e5dacd69d8fa1509f24e69af6b2668823d97834bed5ee69d3ed80702feec2b10322485a988db22f5ba7aa3b4d9f59be627613cb852cb66e17ebcc26a685a192a4959ad6744685ece766316425945cadce1049", 0x80, 0x4, 0x3, 0x0, 0x0, 0x1f, 0x0, 0x1}, r7}}, 0x128) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r3, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xa2c9}]}, 0x2c}}, 0x40001) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000002c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000280), 0x2, {0xa, 0x4e20, 0x101, @local, 0x9}, r7}}, 0x38) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="010034000020009b62e628a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4008840}, 0x24004860) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x60, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xf4}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xfb}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x5) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYRES32=r3, @ANYRES16=r1, @ANYBLOB="010034000020009b62e628a0000008000300", @ANYRES32=r2], 0x1c}}, 0x0) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r4, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x100, 0x70bd25, 0x25dfdbfc, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4008840}, 0x24004860) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x60, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x3}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffe}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0x2}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xf4}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0xfb}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x5}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x5) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x222000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x2, 0x1f, 0x91a, 0x61, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7800, 0x10, 0x4, 0xffff9f96}}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="0100000000000000000001004000"], 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x24}}, 0x20000000) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, 0x0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xac, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x98, 0x20, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x30, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x2c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x20000000) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000005c0), 0x802, 0x0) ioctl$KVM_GET_API_VERSION(r6, 0xae00, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r5, &(0x7f00000003c0)={0x8, 0x120, 0xfa00, {0x0, {0x200, 0x0, "d91241613fb76b36f55bc438e3fa76544b55439593944f1f80f3bab74464a1b400a14d4570157ae20d87c479ebef4ad6b9faf4a49ac6714a75049d038c6fcdcf08a65e5d00000000c0330816797240d00e77bd07f3baa0200555bce3e64dc011ae1aadc831f1183b2cd6f50f4a74dd4730e5001c7eb082232496c21ff2399b4730f98029ab5ee432c22fcd3c13547928de0a07291276ae78c901a007f903af0b414687f66907b1624d8d46f3859e5dacd69d8fa1509f24e69af6b2668823d97834bed5ee69d3ed80702feec2b10322485a988db22f5ba7aa3b4d9f59be627613cb852cb66e17ebcc26a685a192a4959ad6744685ece766316425945cadce1049", 0x80, 0x4, 0x3, 0x0, 0x0, 0x1f, 0x0, 0x1}, r7}}, 0x128) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r3, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xa2c9}]}, 0x2c}}, 0x40001) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000002c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000280), 0x2, {0xa, 0x4e20, 0x101, @local, 0x9}, r7}}, 0x38) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x102, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) socketpair(0x1, 0xa, 0x20000, &(0x7f0000000140)) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r3) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x4000) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="ffcfa386c6b23cff00ab47834253d0eda1a05f3fc49db7b9ba70d4969d9245199fa547775960085c52955e14d917", @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8044}, 0x4020000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r5], 0x1c}}, 0x0) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x1}, 0x14}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2a30000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r5, 0x304, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfff1}]}, 0x48}, 0x1, 0x0, 0x0, 0x48c4}, 0x810) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 32) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}}, 0x0) (async) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8044}, 0x4020000) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r5], 0x1c}}, 0x0) 12:32:20 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x222000, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000080)={'syztnl2\x00', 0x0, 0x29, 0x2, 0x1f, 0x91a, 0x61, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7800, 0x10, 0x4, 0xffff9f96}}) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="0100000000000000000001004000"], 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x10, 0x70bd25, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x4}]}, 0x24}}, 0x20000000) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, 0x0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async, rerun: 32) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000640)={0xac, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x98, 0x20, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_INDEX={0x5}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x30, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x2}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0002}}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}]}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x2c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8}, @NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0102}}]}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x2000c000}, 0x20000000) (async, rerun: 32) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r6 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000005c0), 0x802, 0x0) ioctl$KVM_GET_API_VERSION(r6, 0xae00, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000001c0)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r5, &(0x7f00000003c0)={0x8, 0x120, 0xfa00, {0x0, {0x200, 0x0, "d91241613fb76b36f55bc438e3fa76544b55439593944f1f80f3bab74464a1b400a14d4570157ae20d87c479ebef4ad6b9faf4a49ac6714a75049d038c6fcdcf08a65e5d00000000c0330816797240d00e77bd07f3baa0200555bce3e64dc011ae1aadc831f1183b2cd6f50f4a74dd4730e5001c7eb082232496c21ff2399b4730f98029ab5ee432c22fcd3c13547928de0a07291276ae78c901a007f903af0b414687f66907b1624d8d46f3859e5dacd69d8fa1509f24e69af6b2668823d97834bed5ee69d3ed80702feec2b10322485a988db22f5ba7aa3b4d9f59be627613cb852cb66e17ebcc26a685a192a4959ad6744685ece766316425945cadce1049", 0x80, 0x4, 0x3, 0x0, 0x0, 0x1f, 0x0, 0x1}, r7}}, 0x128) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000300)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r8, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x2c, r3, 0x8, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xa2c9}]}, 0x2c}}, 0x40001) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f00000002c0)={0x10, 0x30, 0xfa00, {&(0x7f0000000280), 0x2, {0xa, 0x4e20, 0x101, @local, 0x9}, r7}}, 0x38) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$VHOST_SET_VRING_ENDIAN(r1, 0x4008af13, &(0x7f00000000c0)={0x2}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2a30000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r5, 0x304, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfff1}]}, 0x48}, 0x1, 0x0, 0x0, 0x48c4}, 0x810) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r2, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x9d, 0x1, 0x66, @dev={0xfe, 0x80, '\x00', 0x22}, @empty, 0x80, 0x8000, 0x5, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'sit0\x00', r1, 0x2f, 0x1f, 0x6, 0x1, 0x23, @private2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8000, 0x9, 0x7}}) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x3, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @private=0xa010102, @broadcast}}}}) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048001}, 0xc0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x3}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x20}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040}, 0x20000085) epoll_create1(0x0) 12:32:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 64) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r3, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}]}, 0x1c}}, 0x0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x38, 0x0, 0x400, 0x70bd25, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x8044}, 0x4020000) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r5], 0x1c}}, 0x0) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x1}, 0x14}}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2a30000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r5, 0x304, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfff1}]}, 0x48}, 0x1, 0x0, 0x0, 0x48c4}, 0x810) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r3) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2a30000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, r5, 0x304, 0x70bd28, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x7f}, @IEEE802154_ATTR_LLSEC_ENABLED={0x5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x1}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfff1}]}, 0x48}, 0x1, 0x0, 0x0, 0x48c4}, 0x810) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:20 executing program 3: socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x3, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @private=0xa010102, @broadcast}}}}) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048001}, 0xc0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x3}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x20}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040}, 0x20000085) (async) epoll_create1(0x0) 12:32:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x9d, 0x1, 0x66, @dev={0xfe, 0x80, '\x00', 0x22}, @empty, 0x80, 0x8000, 0x5, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'sit0\x00', r1, 0x2f, 0x1f, 0x6, 0x1, 0x23, @private2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8000, 0x9, 0x7}}) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(r0, &(0x7f0000000040)={0x28, 0x0, 0x0, @my=0x1}, 0xfffffffffffffdc3) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:20 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000000c0)={0x0, 0x8, 0x8, 0x1, 0xa9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:20 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000240), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000050) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x8014) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:20 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x3, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @private=0xa010102, @broadcast}}}}) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, 0x0, 0x400, 0x70bd2a, 0x25dfdbfe, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x19}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20048001}, 0xc0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x60, 0x0, 0x0, 0x70bd29, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x4}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x4}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x3}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @loopback}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x20}]}, 0x60}, 0x1, 0x0, 0x0, 0x4040}, 0x20000085) (async) epoll_create1(0x0) 12:32:20 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x9d, 0x1, 0x66, @dev={0xfe, 0x80, '\x00', 0x22}, @empty, 0x80, 0x8000, 0x5, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'sit0\x00', r1, 0x2f, 0x1f, 0x6, 0x1, 0x23, @private2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8000, 0x9, 0x7}}) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'syztnl1\x00', 0x0, 0x29, 0x2, 0x9d, 0x1, 0x66, @dev={0xfe, 0x80, '\x00', 0x22}, @empty, 0x80, 0x8000, 0x5, 0x3}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f0000000100)={'sit0\x00', r1, 0x2f, 0x1f, 0x6, 0x1, 0x23, @private2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x8000, 0x8000, 0x9, 0x7}}) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) [ 2519.454781] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40005) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRESHEX=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r1], 0x1c}}, 0x0) 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000240), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000050) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x8014) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000240), r0) (async) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000050) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x8014) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:21 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000000c0)={0x0, 0x8, 0x8, 0x1, 0xa9}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x1, 0x0, 0x20, 0x2f, 0x0, @multicast1, @local}}}}) 12:32:21 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000040)=0x4, 0x4) 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40005) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRESHEX=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r1], 0x1c}}, 0x0) 12:32:21 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x1, 0x0, 0x20, 0x2f, 0x0, @multicast1, @local}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x1, 0x0, 0x20, 0x2f, 0x0, @multicast1, @local}}}}) (async) 12:32:21 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000040)=0x4, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000040)=0x4, 0x4) (async) [ 2519.811820] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:21 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r0, 0xc0305710, &(0x7f00000000c0)={0x0, 0x8, 0x8, 0x1, 0xa9}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000240), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000050) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x8014) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000240), r0) (async) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x24, r1, 0x300, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x24000050) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), r0) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x44, r3, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000040}, 0x8014) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r2, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) (async) 12:32:21 executing program 1: r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), r0) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x40005) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRESHEX=r3, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r1], 0x1c}}, 0x0) 12:32:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'tunl0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x1, 0x0, 0x20, 0x2f, 0x0, @multicast1, @local}}}}) 12:32:21 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0xa, &(0x7f0000000040)=0x4, 0x4) 12:32:21 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x58, r1, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x68}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9f}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x80}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}]}, 0x58}, 0x1, 0x0, 0x0, 0x4048880}, 0x380099ecd0b7bc8e) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r5, 0x300, 0x70bd27, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) [ 2519.979608] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x58, r1, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x68}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9f}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x80}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}]}, 0x58}, 0x1, 0x0, 0x0, 0x4048880}, 0x380099ecd0b7bc8e) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r5, 0x300, 0x70bd27, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:21 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000001c0)={0x8, 0x826, &(0x7f0000000180)="00f48988e50a0129d8388a62055c3e48789bcf79b7349b14375aba83c56814209200cdd4d09cf524", &(0x7f0000000240)="b732675dc00f910e1e97588eead3834342ecd731ae19b8f4964af3013305f7f06611d5f6cf7a3259aa181072051806be782c06fac8543a522302742e4eb5551acd5b8dad9f2e8660a291753d99efafdd8489c71d67ea19a65503a5ddb422b56c376134529682d8b7e8fcf2f4a60cca6337775199eb0ef4e83ccf35237f8a18c7c9ad2b119920c72bd0", 0x28, 0x89}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r1, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1, 0x6, 0xe0, 0x10, 0xffffffffffffffff, 0x6, '\x00', r1, 0xffffffffffffffff, 0x4, 0x3, 0x5, 0x5}, 0x48) 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x80}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x19}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x68}, 0x1, 0x0, 0x0, 0x448d4}, 0x4040800) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x21, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8040) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="000000007f8925dfc346f48c93d120b5f05200"/28, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:21 executing program 0: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x2, {0xa, 0x4e21, 0x1ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10001}}}, 0x38) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000180)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r3, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x58, r1, 0x300, 0x70bd2c, 0x25dfdbfd, {}, [@IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x68}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xfffc}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9f}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x80}, @IEEE802154_ATTR_STATUS={0x5, 0x3, 0x3f}]}, 0x58}, 0x1, 0x0, 0x0, 0x4048880}, 0x380099ecd0b7bc8e) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000000), r2) sendmsg$IEEE802154_SET_MACPARAMS(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x28, r5, 0x300, 0x70bd27, 0xfffffffe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}]}, 0x28}}, 0x0) 12:32:21 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000001c0)={0x8, 0x826, &(0x7f0000000180)="00f48988e50a0129d8388a62055c3e48789bcf79b7349b14375aba83c56814209200cdd4d09cf524", &(0x7f0000000240)="b732675dc00f910e1e97588eead3834342ecd731ae19b8f4964af3013305f7f06611d5f6cf7a3259aa181072051806be782c06fac8543a522302742e4eb5551acd5b8dad9f2e8660a291753d99efafdd8489c71d67ea19a65503a5ddb422b56c376134529682d8b7e8fcf2f4a60cca6337775199eb0ef4e83ccf35237f8a18c7c9ad2b119920c72bd0", 0x28, 0x89}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r1, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1, 0x6, 0xe0, 0x10, 0xffffffffffffffff, 0x6, '\x00', r1, 0xffffffffffffffff, 0x4, 0x3, 0x5, 0x5}, 0x48) 12:32:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) (async) 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x80}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x19}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x68}, 0x1, 0x0, 0x0, 0x448d4}, 0x4040800) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x21, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8040) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="000000007f8925dfc346f48c93d120b5f05200"/28, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:21 executing program 0: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) (async) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x2, {0xa, 0x4e21, 0x1ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10001}}}, 0x38) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000180)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:21 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 4: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000001c0)={0x8, 0x826, &(0x7f0000000180)="00f48988e50a0129d8388a62055c3e48789bcf79b7349b14375aba83c56814209200cdd4d09cf524", &(0x7f0000000240)="b732675dc00f910e1e97588eead3834342ecd731ae19b8f4964af3013305f7f06611d5f6cf7a3259aa181072051806be782c06fac8543a522302742e4eb5551acd5b8dad9f2e8660a291753d99efafdd8489c71d67ea19a65503a5ddb422b56c376134529682d8b7e8fcf2f4a60cca6337775199eb0ef4e83ccf35237f8a18c7c9ad2b119920c72bd0", 0x28, 0x89}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r1, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1, 0x6, 0xe0, 0x10, 0xffffffffffffffff, 0x6, '\x00', r1, 0xffffffffffffffff, 0x4, 0x3, 0x5, 0x5}, 0x48) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f00000001c0)={0x8, 0x826, &(0x7f0000000180)="00f48988e50a0129d8388a62055c3e48789bcf79b7349b14375aba83c56814209200cdd4d09cf524", &(0x7f0000000240)="b732675dc00f910e1e97588eead3834342ecd731ae19b8f4964af3013305f7f06611d5f6cf7a3259aa181072051806be782c06fac8543a522302742e4eb5551acd5b8dad9f2e8660a291753d99efafdd8489c71d67ea19a65503a5ddb422b56c376134529682d8b7e8fcf2f4a60cca6337775199eb0ef4e83ccf35237f8a18c7c9ad2b119920c72bd0", 0x28, 0x89}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r1, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x1, 0x6, 0xe0, 0x10, 0xffffffffffffffff, 0x6, '\x00', r1, 0xffffffffffffffff, 0x4, 0x3, 0x5, 0x5}, 0x48) (async) 12:32:21 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44080}, 0x8000) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x60, r1, 0x300, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x6}, @IEEE802154_ATTR_CSMA_RETRIES={0x5, 0x25, 0x9}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x2a01}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x60}}, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x60a40, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r5, 0xc01064c1, &(0x7f0000000500)) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="000100e5", @ANYRES16=r1, @ANYBLOB="00022dbd7000ffdbdf252d0000000600060002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4014) 12:32:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_ASSOCIATE_REQ(r0, &(0x7f0000000340)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x68, 0x0, 0x100, 0x70bd29, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_CAPABILITY={0x5, 0x11, 0x80}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_PAGE={0x5, 0x1d, 0x19}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}]}, 0x68}, 0x1, 0x0, 0x0, 0x448d4}, 0x4040800) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r2, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x1c, r1, 0x4, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_SEC_FRAME_COUNTER={0x8, 0x21, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8040) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="000000007f8925dfc346f48c93d120b5f05200"/28, @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:21 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) (async) 12:32:21 executing program 0: r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x2, {0xa, 0x4e21, 0x1ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10001}}}, 0x38) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000180)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz1\x00', 0x200002, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000140)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x2, {0xa, 0x4e21, 0x1ff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x10001}}}, 0x38) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_NOTIFY(r2, &(0x7f0000000180)={0xf, 0x8, 0xfa00, {0xffffffffffffffff, 0x5}}, 0x10) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:21 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:21 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0000000100000078e0000001ac1414aa00000000000000000000000000000000ccc1a7214e8c13950b6a434417b6649b0a31dd947b43a108f3b861c442b48a49e64a711bb620942f9bdee9372446ee325b8a"]}) 12:32:22 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44080}, 0x8000) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x60, r1, 0x300, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x6}, @IEEE802154_ATTR_CSMA_RETRIES={0x5, 0x25, 0x9}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x2a01}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x60}}, 0x0) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x60a40, 0x0) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r5, 0xc01064c1, &(0x7f0000000500)) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x10) (async) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="000100e5", @ANYRES16=r1, @ANYBLOB="00022dbd7000ffdbdf252d0000000600060002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4014) 12:32:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2711, @local}, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="015695b41a3adb88803c71000000", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0000000100000078e0000001ac1414aa00000000000000000000000000000000ccc1a7214e8c13950b6a434417b6649b0a31dd947b43a108f3b861c442b48a49e64a711bb620942f9bdee9372446ee325b8a"]}) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r9, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x8884) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000380)={&(0x7f0000000200), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r2, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xc5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x48) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r11], 0x1c}}, 0x0) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r12, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008041}, 0x4c819) 12:32:22 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x707, 0x700, 0x3, 0x0, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x67, 0x0, 0x8, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@timestamp={0x44, 0xc, 0xb2, 0x0, 0x7, [0x5, 0x80000001]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x3f, 0x3, 0x6, 0x7, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0xf820, 0xd254, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl2\x00', r2, 0x2f, 0x3, 0x7, 0x3, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x10, 0x5, 0x2}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x6, 0x8) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000240)=0x3e2, 0x4) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) 12:32:22 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000180)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44080}, 0x8000) (async) sendmsg$IEEE802154_SET_MACPARAMS(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)={0x60, r1, 0x300, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8}, @IEEE802154_ATTR_TXPOWER={0x5, 0x21, 0x6}, @IEEE802154_ATTR_CSMA_RETRIES={0x5, 0x25, 0x9}, @IEEE802154_ATTR_CCA_MODE={0x5, 0x23, 0x7f}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_CCA_ED_LEVEL={0x8, 0x24, 0x2a01}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x60}}, 0x0) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x60a40, 0x0) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r5, 0xc01064c1, &(0x7f0000000500)) (async) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r4, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8080}, 0x10) (async) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="000100e5", @ANYRES16=r1, @ANYBLOB="00022dbd7000ffdbdf252d0000000600060002000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4014) 12:32:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="0000000100000078e0000001ac1414aa00000000000000000000000000000000ccc1a7214e8c13950b6a434417b6649b0a31dd947b43a108f3b861c442b48a49e64a711bb620942f9bdee9372446ee325b8a"]}) 12:32:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2711, @local}, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="015695b41a3adb88803c71000000", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r9, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x8884) (async) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000380)={&(0x7f0000000200), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r2, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xc5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x48) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r11], 0x1c}}, 0x0) (async) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r12, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008041}, 0x4c819) 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, 0x0, 0x20000004) 12:32:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x707, 0x700, 0x3, 0x0, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x67, 0x0, 0x8, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@timestamp={0x44, 0xc, 0xb2, 0x0, 0x7, [0x5, 0x80000001]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x3f, 0x3, 0x6, 0x7, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0xf820, 0xd254, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl2\x00', r2, 0x2f, 0x3, 0x7, 0x3, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x10, 0x5, 0x2}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x6, 0x8) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000240)=0x3e2, 0x4) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x707, 0x700, 0x3, 0x0, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x67, 0x0, 0x8, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@timestamp={0x44, 0xc, 0xb2, 0x0, 0x7, [0x5, 0x80000001]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x3f, 0x3, 0x6, 0x7, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0xf820, 0xd254, 0x5}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl2\x00', r2, 0x2f, 0x3, 0x7, 0x3, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x10, 0x5, 0x2}}) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$inet6(0xa, 0x6, 0x8) (async) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000240)=0x3e2, 0x4) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) (async) 12:32:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) connect$vsock_dgram(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2711, @local}, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="015695b41a3adb88803c71000000", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:22 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4084010}, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0x50, 0x0, 0x400, 0x870bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x8004) r3 = socket$nl_generic(0x10, 0x3, 0x10) clock_settime(0x2, &(0x7f00000005c0)={0x0, 0x989680}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="000000010000000000000000458000148000000000009078e0000001ac1414aa"]}) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x24001}, 0x20000810) 12:32:22 executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, 0x0, 0x800, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x8}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x30}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x5) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="20000000e73ad083fccd7a7923480e864f61adaf855cfe6b6a901f75e68ed79cd3e60223e9e7003fee256a5a773fb7ba93087c4f70afa4e4b9480c415ae6f1def056ea7ba2819463ce3954fb79ef21ae8f290311397a5072a1f336ed9f3631287b705e555e280aa0e82ee36f008bd1adb34f7646e2e0674edebfd6af604bb53f3a8223", @ANYRES16=r2, @ANYBLOB="9f000e9300000014000000feb23510723c203f3967f4b7a8d78dbe7ce7fe126257c57ff4ad8da374a08800000000000000"], 0x20}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_VLAN(r1, &(0x7f0000000580)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x41}, 0x20004800) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', &(0x7f0000000140)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x40, 0xaf3b, {{0x2d, 0x4, 0x0, 0x2, 0xb4, 0x65, 0x0, 0x9, 0x2d, 0x0, @rand_addr=0x64010101, @rand_addr=0x64010100, {[@end, @ssrr={0x89, 0x1b, 0x81, [@local, @multicast2, @remote, @local, @broadcast, @empty]}, @ssrr={0x89, 0x7, 0xdc, [@dev={0xac, 0x14, 0x14, 0x25}]}, @noop, @timestamp_addr={0x44, 0x24, 0xe8, 0x1, 0x3, [{@multicast1, 0x1}, {@loopback, 0x1000}, {@private=0xa010101, 0x528}, {@dev={0xac, 0x14, 0x14, 0xb}, 0x9}]}, @generic={0x88, 0xa, "6ae1c2ce30c737e2"}, @cipso={0x86, 0x4b, 0xffffffffffffffff, [{0x1, 0x3, "bf"}, {0x5, 0x12, "cfacf5441680f5b70b9878d06878f4f0"}, {0x0, 0xb, "5c363e1e219b3f3717"}, {0x0, 0xd, "2249348a80127cdc009676"}, {0x5, 0x8, "fb5c5d633adb"}, {0x7, 0x4, "37fc"}, {0x0, 0xc, "8d614b24b4c38169e54e"}]}]}}}}}) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="440000000ebc22ae5124312a13bfd150df98b34d2119fe9042817d692f13abea3120a56ca61ef5b48e27a9f98c08e46d6de4a1f5d8e001630013e0e781818e2141944a578270e0515a787dfe4acbc927200e0f51dd337125d7ef515034b10a9f798b678e120a12a75ea14eaeaedc769b2a3a29143bdebae7593ec3eed3e8d5985bb0723fc4c295637e0f5cef85c8cec35b353b71d9e29150c125a2f1e056f415969fe19d618debb0384fb86bbc403877ecd9ec5b6c50d6ab419282c34e119d4085fc9643f6cdae6cdf4259ad23fd0ebe1f748172295a586bef713640f97740cf5601327d57daa27c17b401db3c68c8a6abf92126e56f4b36ea068f8679d7b7124b80774bdd45dd21bc2e562ef4f670700a2f0e59b5bc4ddfae942b18b13e4bbb20f78e2ebe0e284b77906c8f8c9ed714b85d741e0092a99e168e636f046a3b2136ef6998d29bd0fe61faded141b1aca327769be68ab65b56c031297f1f2978bcc8eca39df66dd0ec81525cda883c479f5542da4f6441015c30742787a4bcbf642b463b7f11cac2fe9855773fbde1070125867b7e34e342e99eee88b712f0939e8559894a86f266ead2ef74437d70a122f598275481", @ANYRESHEX=r1, @ANYBLOB="00002cbd7000ffdbdf250700000008002c000008000008003a0000000e0008000300", @ANYRES32=r5, @ANYBLOB="08000000000008003100d50ff74b", @ANYRESDEC=r5, @ANYRES32=r6], 0x44}, 0x1, 0x0, 0x0, 0x48085}, 0x81) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000280), r0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) (async, rerun: 32) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r6) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 32) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r9, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x1c, r7, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}}, 0x8884) (async) sendmsg$IEEE802154_LLSEC_DEL_KEY(r0, &(0x7f0000000380)={&(0x7f0000000200), 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x4c, r2, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0xc5}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x48) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r11], 0x1c}}, 0x0) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r12, 0x100, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x20008041}, 0x4c819) 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, 0x0, 0x20000004) 12:32:22 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4084010}, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0x50, 0x0, 0x400, 0x870bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x8004) r3 = socket$nl_generic(0x10, 0x3, 0x10) clock_settime(0x2, &(0x7f00000005c0)={0x0, 0x989680}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="000000010000000000000000458000148000000000009078e0000001ac1414aa"]}) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x24001}, 0x20000810) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4084010}, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) (async) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0x50, 0x0, 0x400, 0x870bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x8004) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) clock_settime(0x2, &(0x7f00000005c0)={0x0, 0x989680}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="000000010000000000000000458000148000000000009078e0000001ac1414aa"]}) (async) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x24001}, 0x20000810) (async) 12:32:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x200008c0}, 0x40004) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \b\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:22 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 1) 12:32:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x707, 0x700, 0x3, 0x0, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x67, 0x0, 0x8, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@timestamp={0x44, 0xc, 0xb2, 0x0, 0x7, [0x5, 0x80000001]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x3f, 0x3, 0x6, 0x7, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0xf820, 0xd254, 0x5}}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl2\x00', r2, 0x2f, 0x3, 0x7, 0x3, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x10, 0x5, 0x2}}) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x6, 0x8) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000240)=0x3e2, 0x4) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000040), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000002c0)={'ip_vti0\x00', &(0x7f0000000280)={'tunl0\x00', 0x0, 0x707, 0x700, 0x3, 0x0, {{0x8, 0x4, 0x3, 0x8, 0x20, 0x67, 0x0, 0x8, 0x4, 0x0, @local, @rand_addr=0x64010101, {[@timestamp={0x44, 0xc, 0xb2, 0x0, 0x7, [0x5, 0x80000001]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'sit0\x00', 0x0, 0x4, 0x3f, 0x3, 0x6, 0x7, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, 0x700, 0xf820, 0xd254, 0x5}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r1, 0x89f6, &(0x7f0000000200)={'ip6gre0\x00', &(0x7f0000000180)={'syztnl2\x00', r2, 0x2f, 0x3, 0x7, 0x3, 0x20, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00', 0x40, 0x10, 0x5, 0x2}}) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$inet6(0xa, 0x6, 0x8) (async) setsockopt$inet6_udp_int(r3, 0x11, 0xb, &(0x7f0000000240)=0x3e2, 0x4) (async) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, 0xffffffffffffffff, 0x0, 0x1, 0x4}}, 0x20) (async) 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, 0x0, 0x20000004) 12:32:22 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000280)={'wpan4\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x20, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4084010}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), r0) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r2, 0x20, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4000) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={0x50, 0x0, 0x400, 0x870bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5, 0x37, 0x1}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x3}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r1}, @IEEE802154_ATTR_HW_ADDR={0xc}]}, 0x50}, 0x1, 0x0, 0x0, 0x800}, 0x8004) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) clock_settime(0x2, &(0x7f00000005c0)={0x0, 0x989680}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="000000010000000000000000458000148000000000009078e0000001ac1414aa"]}) (async) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f0000000480)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f00000001c0)={0x38, 0x0, 0x1, 0x70bd26, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x38}, 0x1, 0x0, 0x0, 0x24001}, 0x20000810) 12:32:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x200008c0}, 0x40004) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \b\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), r2) sendmsg$NLBL_CALIPSO_C_LIST(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}}, 0x0) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r4, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x850}, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2520.859307] FAULT_INJECTION: forcing a failure. [ 2520.859307] name failslab, interval 1, probability 0, space 0, times 0 [ 2520.895571] CPU: 0 PID: 1552 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2520.903383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2520.912731] Call Trace: [ 2520.915321] dump_stack+0x1b2/0x281 [ 2520.918954] should_fail.cold+0x10a/0x149 [ 2520.923100] should_failslab+0xd6/0x130 [ 2520.927071] kmem_cache_alloc_node+0x263/0x410 [ 2520.931652] __alloc_skb+0x5c/0x510 [ 2520.935278] netlink_sendmsg+0x91e/0xbc0 [ 2520.939344] ? nlmsg_notify+0x1b0/0x1b0 [ 2520.943312] ? kernel_recvmsg+0x210/0x210 [ 2520.947456] ? security_socket_sendmsg+0x83/0xb0 [ 2520.952217] ? nlmsg_notify+0x1b0/0x1b0 [ 2520.956196] sock_sendmsg+0xb5/0x100 [ 2520.959911] ___sys_sendmsg+0x6c8/0x800 [ 2520.963892] ? get_pid_task+0x91/0x130 [ 2520.967779] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2520.972537] ? lock_downgrade+0x740/0x740 [ 2520.976684] ? __fget+0x23e/0x3e0 [ 2520.980137] ? lock_acquire+0x170/0x3f0 [ 2520.984103] ? lock_downgrade+0x740/0x740 [ 2520.988250] ? __fget+0x265/0x3e0 [ 2520.991704] ? __fdget+0x19b/0x1f0 [ 2520.995243] ? sockfd_lookup_light+0xb2/0x160 [ 2520.999740] __sys_sendmsg+0xa3/0x120 [ 2521.003539] ? SyS_shutdown+0x160/0x160 [ 2521.007510] ? wait_for_completion_io+0x10/0x10 [ 2521.012220] ? SyS_read+0x210/0x210 [ 2521.015851] ? __do_page_fault+0x159/0xad0 [ 2521.020084] SyS_sendmsg+0x27/0x40 [ 2521.023617] ? __sys_sendmsg+0x120/0x120 [ 2521.027675] do_syscall_64+0x1d5/0x640 [ 2521.031563] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2521.036742] RIP: 0033:0x7fc05f6a20e9 [ 2521.040428] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2521.048110] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:22 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x200008c0}, 0x40004) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \b\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r1, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x28, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r0, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x30, r2, 0x400, 0x70bd29, 0x25dfdbfd, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x200008c0}, 0x40004) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \b\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), r2) sendmsg$NLBL_CALIPSO_C_LIST(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}}, 0x0) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r4, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x850}, 0x10) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:22 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x82600, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f0000000080)=0x7fffffff, 0x4) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4040080) [ 2521.055355] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2521.062601] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2521.069845] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2521.077102] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:22 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 2) 12:32:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:22 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x82600, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f0000000080)=0x7fffffff, 0x4) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4040080) 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:22 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000080), r2) sendmsg$NLBL_CALIPSO_C_LIST(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}}, 0x0) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x34, r4, 0x2, 0x70bd27, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x850}, 0x10) (async) r5 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r6], 0x1c}}, 0x0) 12:32:22 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:22 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) [ 2521.209589] FAULT_INJECTION: forcing a failure. [ 2521.209589] name failslab, interval 1, probability 0, space 0, times 0 [ 2521.247883] CPU: 0 PID: 1627 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2521.255699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2521.265045] Call Trace: [ 2521.267633] dump_stack+0x1b2/0x281 [ 2521.271260] should_fail.cold+0x10a/0x149 [ 2521.275406] should_failslab+0xd6/0x130 [ 2521.279375] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2521.284478] __kmalloc_node_track_caller+0x38/0x70 [ 2521.289404] __alloc_skb+0x96/0x510 [ 2521.293031] netlink_sendmsg+0x91e/0xbc0 [ 2521.297091] ? nlmsg_notify+0x1b0/0x1b0 [ 2521.301066] ? kernel_recvmsg+0x210/0x210 [ 2521.305215] ? security_socket_sendmsg+0x83/0xb0 [ 2521.309968] ? nlmsg_notify+0x1b0/0x1b0 [ 2521.313947] sock_sendmsg+0xb5/0x100 [ 2521.317660] ___sys_sendmsg+0x6c8/0x800 [ 2521.321628] ? get_pid_task+0x91/0x130 [ 2521.325509] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2521.330263] ? lock_downgrade+0x740/0x740 [ 2521.334409] ? __fget+0x23e/0x3e0 [ 2521.337859] ? lock_acquire+0x170/0x3f0 [ 2521.341831] ? lock_downgrade+0x740/0x740 [ 2521.345985] ? __fget+0x265/0x3e0 [ 2521.349435] ? __fdget+0x19b/0x1f0 [ 2521.352970] ? sockfd_lookup_light+0xb2/0x160 [ 2521.357460] __sys_sendmsg+0xa3/0x120 [ 2521.361255] ? SyS_shutdown+0x160/0x160 [ 2521.365235] ? wait_for_completion_io+0x10/0x10 [ 2521.369913] ? SyS_read+0x210/0x210 [ 2521.373537] ? __do_page_fault+0x159/0xad0 [ 2521.377769] SyS_sendmsg+0x27/0x40 [ 2521.381307] ? __sys_sendmsg+0x120/0x120 [ 2521.385364] do_syscall_64+0x1d5/0x640 [ 2521.389255] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2521.394434] RIP: 0033:0x7fc05f6a20e9 [ 2521.398144] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:22 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, r4, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x48080}, 0x20000006) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=r1, @ANYBLOB="01000003000000009ebb3cfde2759911ecf3407a7e347837262f46ad8edbc6b8c48a14733af404846674694b5bbbc0f1d3417ae50a5fbbf83e000000001719f8ebe2b357486d661ec99394ca2d0dc51c70baafc50c0e814efcfc642c8291ff73868c4b1af8b32ea8cdd73c79b9e4841e4e36ef9c5048e6d302ee3d4af4a14370eccc52784976bc94d8f69d2edcd08d5bfecc2195738b8cc5b4ba409c06730d40a2ef17104ff85653ffd281ea237be01393240b26c6d4b3d7bf153e3137e32819f5ec79eb28aad38ded777eb9a31eee598b0545dcde7e48f5394197c735687534ffa5adf52e508636d8e1f5dbf494bc803ecf86707d4daf481c5d11b3fecb15f4506378e6581ad36b0ea47d9911993d611c", @ANYRES32], 0x1c}}, 0x0) 12:32:23 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000)=0xfffffffb, 0x4) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000040), 0x8400, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x82600, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0xa, &(0x7f0000000080)=0x7fffffff, 0x4) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x1}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x4040080) 12:32:23 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:23 executing program 4: socket$inet6(0xa, 0x6, 0x27ff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x64, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffffe}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x200008c0}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2521.405844] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2521.413109] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2521.420369] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2521.427631] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2521.434893] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:23 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 3) 12:32:23 executing program 4: socket$inet6(0xa, 0x6, 0x27ff) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x64, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffffe}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x200008c0}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:23 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, r4, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x48080}, 0x20000006) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=r1, @ANYBLOB="01000003000000009ebb3cfde2759911ecf3407a7e347837262f46ad8edbc6b8c48a14733af404846674694b5bbbc0f1d3417ae50a5fbbf83e000000001719f8ebe2b357486d661ec99394ca2d0dc51c70baafc50c0e814efcfc642c8291ff73868c4b1af8b32ea8cdd73c79b9e4841e4e36ef9c5048e6d302ee3d4af4a14370eccc52784976bc94d8f69d2edcd08d5bfecc2195738b8cc5b4ba409c06730d40a2ef17104ff85653ffd281ea237be01393240b26c6d4b3d7bf153e3137e32819f5ec79eb28aad38ded777eb9a31eee598b0545dcde7e48f5394197c735687534ffa5adf52e508636d8e1f5dbf494bc803ecf86707d4daf481c5d11b3fecb15f4506378e6581ad36b0ea47d9911993d611c", @ANYRES32], 0x1c}}, 0x0) 12:32:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x5, 0xe69, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7, 0x700, 0x6, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r1, 0x2f, 0x1f, 0x8, 0x1, 0x1c, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x20, 0x10, 0x9, 0x7f}}) 12:32:23 executing program 4: socket$inet6(0xa, 0x6, 0x27ff) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x64, 0x0, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x5}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xfffffff7}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x5}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffffe}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x200008c0}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:23 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r3, 0x400, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x8004) 12:32:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2521.638630] FAULT_INJECTION: forcing a failure. [ 2521.638630] name failslab, interval 1, probability 0, space 0, times 0 [ 2521.681922] CPU: 1 PID: 1695 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2521.689732] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2521.699078] Call Trace: [ 2521.701658] dump_stack+0x1b2/0x281 [ 2521.705293] should_fail.cold+0x10a/0x149 [ 2521.709447] should_failslab+0xd6/0x130 [ 2521.713423] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2521.718093] nbd_alloc_config+0x3c/0x150 [ 2521.722163] nbd_genl_connect+0x40f/0x1400 [ 2521.726397] ? nbd_xmit_timeout+0x500/0x500 12:32:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x5, 0xe69, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7, 0x700, 0x6, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r1, 0x2f, 0x1f, 0x8, 0x1, 0x1c, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x20, 0x10, 0x9, 0x7f}}) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x5, 0xe69, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7, 0x700, 0x6, 0x4}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r1, 0x2f, 0x1f, 0x8, 0x1, 0x1c, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x20, 0x10, 0x9, 0x7f}}) (async) [ 2521.730714] ? validate_nla+0x192/0x5e0 [ 2521.734683] ? nla_parse+0x157/0x1f0 [ 2521.738392] genl_family_rcv_msg+0x572/0xb20 [ 2521.742799] ? genl_rcv+0x40/0x40 [ 2521.746249] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2521.751699] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2521.756792] ? trace_hardirqs_on+0x10/0x10 [ 2521.761026] genl_rcv_msg+0xaf/0x140 [ 2521.764736] netlink_rcv_skb+0x125/0x390 [ 2521.768792] ? genl_family_rcv_msg+0xb20/0xb20 [ 2521.773366] ? netlink_ack+0x9a0/0x9a0 [ 2521.777245] ? lock_acquire+0x170/0x3f0 12:32:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48885}, 0x20004000) [ 2521.781223] genl_rcv+0x24/0x40 [ 2521.784496] netlink_unicast+0x437/0x610 [ 2521.788561] ? netlink_sendskb+0xd0/0xd0 [ 2521.792617] ? __check_object_size+0x179/0x230 [ 2521.797195] netlink_sendmsg+0x648/0xbc0 [ 2521.801250] ? nlmsg_notify+0x1b0/0x1b0 [ 2521.805215] ? kernel_recvmsg+0x210/0x210 [ 2521.809361] ? security_socket_sendmsg+0x83/0xb0 [ 2521.814105] ? nlmsg_notify+0x1b0/0x1b0 [ 2521.818074] sock_sendmsg+0xb5/0x100 [ 2521.821782] ___sys_sendmsg+0x6c8/0x800 [ 2521.825748] ? get_pid_task+0x91/0x130 12:32:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async, rerun: 32) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48885}, 0x20004000) (rerun: 32) [ 2521.829627] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2521.834390] ? lock_downgrade+0x740/0x740 [ 2521.838533] ? __fget+0x23e/0x3e0 [ 2521.841985] ? lock_acquire+0x170/0x3f0 [ 2521.845952] ? lock_downgrade+0x740/0x740 [ 2521.850184] ? __fget+0x265/0x3e0 [ 2521.853732] ? __fdget+0x19b/0x1f0 [ 2521.857267] ? sockfd_lookup_light+0xb2/0x160 [ 2521.861759] __sys_sendmsg+0xa3/0x120 [ 2521.865554] ? SyS_shutdown+0x160/0x160 [ 2521.869525] ? wait_for_completion_io+0x10/0x10 [ 2521.874196] ? SyS_read+0x210/0x210 [ 2521.877815] ? __do_page_fault+0x159/0xad0 [ 2521.882049] SyS_sendmsg+0x27/0x40 [ 2521.885581] ? __sys_sendmsg+0x120/0x120 [ 2521.889638] do_syscall_64+0x1d5/0x640 [ 2521.893532] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2521.898722] RIP: 0033:0x7fc05f6a20e9 [ 2521.902420] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2521.910111] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2521.917361] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2521.924608] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2521.931856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2521.939135] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:23 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 4) 12:32:23 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x5}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x48885}, 0x20004000) 12:32:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f0000000040)={'ip6gre0\x00', 0x0, 0x2f, 0x6, 0x5, 0xe69, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @mcast1, 0x7, 0x700, 0x6, 0x4}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', r1, 0x2f, 0x1f, 0x8, 0x1, 0x1c, @local, @private1={0xfc, 0x1, '\x00', 0x1}, 0x20, 0x10, 0x9, 0x7f}}) 12:32:23 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2522.084996] nbd: couldn't allocate config 12:32:23 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$nbd(&(0x7f00000001c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r3) sendmsg$IEEE802154_LLSEC_ADD_DEV(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_ADD_IFACE(r2, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, r4, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5, 0x20, 0x1}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x48080}, 0x20000006) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYRESOCT=r1, @ANYRES16=r1, @ANYBLOB="01000003000000009ebb3cfde2759911ecf3407a7e347837262f46ad8edbc6b8c48a14733af404846674694b5bbbc0f1d3417ae50a5fbbf83e000000001719f8ebe2b357486d661ec99394ca2d0dc51c70baafc50c0e814efcfc642c8291ff73868c4b1af8b32ea8cdd73c79b9e4841e4e36ef9c5048e6d302ee3d4af4a14370eccc52784976bc94d8f69d2edcd08d5bfecc2195738b8cc5b4ba409c06730d40a2ef17104ff85653ffd281ea237be01393240b26c6d4b3d7bf153e3137e32819f5ec79eb28aad38ded777eb9a31eee598b0545dcde7e48f5394197c735687534ffa5adf52e508636d8e1f5dbf494bc803ecf86707d4daf481c5d11b3fecb15f4506378e6581ad36b0ea47d9911993d611c", @ANYRES32], 0x1c}}, 0x0) 12:32:23 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r3, 0x400, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x8004) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r3, 0x400, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x8004) (async) 12:32:23 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0xf}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2522.211404] FAULT_INJECTION: forcing a failure. [ 2522.211404] name failslab, interval 1, probability 0, space 0, times 0 [ 2522.244539] CPU: 1 PID: 1755 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2522.252352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2522.261703] Call Trace: [ 2522.264290] dump_stack+0x1b2/0x281 [ 2522.267917] should_fail.cold+0x10a/0x149 [ 2522.272067] should_failslab+0xd6/0x130 [ 2522.276039] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2522.280701] ? dev_uevent_filter+0xd0/0xd0 [ 2522.284935] kobject_uevent_env+0x20c/0xf30 [ 2522.289260] ? wait_for_completion_io+0x10/0x10 [ 2522.294021] ? is_acpi_device_node+0x5b/0x70 [ 2522.298442] device_del+0x642/0xa80 [ 2522.302077] ? __device_links_no_driver+0x1b0/0x1b0 [ 2522.307103] device_unregister+0x22/0xc0 [ 2522.311166] bdi_unregister+0x42f/0x610 [ 2522.315139] ? wb_blkcg_offline+0x180/0x180 [ 2522.319467] del_gendisk+0x453/0x820 [ 2522.323175] ? refcount_dec_not_one+0x75/0xc0 [ 2522.327665] ? disk_events_poll_msecs_store+0x150/0x150 [ 2522.333025] ? wait_for_completion_io+0x10/0x10 [ 2522.337683] nbd_put.part.0+0xb0/0x140 [ 2522.341561] nbd_genl_connect+0xfa9/0x1400 [ 2522.345794] ? nbd_xmit_timeout+0x500/0x500 [ 2522.350113] ? validate_nla+0x192/0x5e0 [ 2522.354072] ? nla_parse+0x157/0x1f0 [ 2522.357765] genl_family_rcv_msg+0x572/0xb20 [ 2522.362152] ? genl_rcv+0x40/0x40 [ 2522.365590] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2522.371029] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2522.376116] ? trace_hardirqs_on+0x10/0x10 [ 2522.380340] genl_rcv_msg+0xaf/0x140 [ 2522.384042] netlink_rcv_skb+0x125/0x390 [ 2522.388095] ? genl_family_rcv_msg+0xb20/0xb20 [ 2522.392653] ? netlink_ack+0x9a0/0x9a0 [ 2522.396527] ? lock_acquire+0x170/0x3f0 [ 2522.400489] genl_rcv+0x24/0x40 [ 2522.403746] netlink_unicast+0x437/0x610 [ 2522.407785] ? netlink_sendskb+0xd0/0xd0 [ 2522.411838] ? __check_object_size+0x179/0x230 [ 2522.416509] netlink_sendmsg+0x648/0xbc0 [ 2522.420676] ? nlmsg_notify+0x1b0/0x1b0 [ 2522.424642] ? kernel_recvmsg+0x210/0x210 [ 2522.428781] ? security_socket_sendmsg+0x83/0xb0 [ 2522.433521] ? nlmsg_notify+0x1b0/0x1b0 [ 2522.437485] sock_sendmsg+0xb5/0x100 [ 2522.441187] ___sys_sendmsg+0x6c8/0x800 [ 2522.445226] ? get_pid_task+0x91/0x130 [ 2522.449097] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2522.453837] ? lock_downgrade+0x740/0x740 [ 2522.457966] ? __fget+0x23e/0x3e0 [ 2522.461398] ? lock_acquire+0x170/0x3f0 [ 2522.465350] ? lock_downgrade+0x740/0x740 [ 2522.469478] ? __fget+0x265/0x3e0 [ 2522.472908] ? __fdget+0x19b/0x1f0 [ 2522.476439] ? sockfd_lookup_light+0xb2/0x160 [ 2522.480928] __sys_sendmsg+0xa3/0x120 [ 2522.484709] ? SyS_shutdown+0x160/0x160 [ 2522.488669] ? wait_for_completion_io+0x10/0x10 [ 2522.493319] ? SyS_read+0x210/0x210 [ 2522.496930] ? __do_page_fault+0x159/0xad0 [ 2522.501150] SyS_sendmsg+0x27/0x40 [ 2522.504672] ? __sys_sendmsg+0x120/0x120 [ 2522.508714] do_syscall_64+0x1d5/0x640 [ 2522.512588] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2522.517849] RIP: 0033:0x7fc05f6a20e9 [ 2522.521542] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2522.529233] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2522.536489] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2522.543748] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2522.551000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 12:32:24 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0xf}}, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) [ 2522.558252] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:24 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 5) 12:32:24 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r0, 0x5761, &(0x7f0000000000)={0x7, 0x0, [{0xdd9e, 0x2, 0x8, [0x9314, 0x2, 0x4, 0x0, 0x7, 0x6, 0x3, 0xa9]}, {0x401, 0x7, 0x8, [0xffd, 0xfff, 0x10000, 0xffffffff, 0x8, 0xab5, 0x5, 0xffff]}, {0x80, 0x6514, 0xf6, [0x2, 0x3, 0x60bb8246, 0x4, 0x3, 0xec1f, 0x4693, 0x8]}, {0x0, 0xa8000000, 0x1000, [0x3, 0x3, 0x92, 0x48335172, 0x80000000, 0x2, 0x7fa, 0x3]}, {0x0, 0x5, 0x2, [0x5, 0x0, 0x3, 0x10001, 0x41da, 0x930, 0x9, 0x200]}, {0x1, 0x0, 0x0, [0xfffffffc, 0x4, 0x7fffffff, 0xd6, 0x7fff, 0x80, 0xecb7, 0x1]}, {0x7ff, 0x200, 0x7f, [0x401, 0xbd, 0x200, 0x9, 0x200, 0xdda0, 0x7, 0x2]}]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:24 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:24 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f00000000c0), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r3, 0x400, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x8000) (async, rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x8004) (rerun: 64) 12:32:24 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_GETPARAMS(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}]}, 0xf}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) (async) 12:32:24 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r0, 0x5761, &(0x7f0000000000)={0x7, 0x0, [{0xdd9e, 0x2, 0x8, [0x9314, 0x2, 0x4, 0x0, 0x7, 0x6, 0x3, 0xa9]}, {0x401, 0x7, 0x8, [0xffd, 0xfff, 0x10000, 0xffffffff, 0x8, 0xab5, 0x5, 0xffff]}, {0x80, 0x6514, 0xf6, [0x2, 0x3, 0x60bb8246, 0x4, 0x3, 0xec1f, 0x4693, 0x8]}, {0x0, 0xa8000000, 0x1000, [0x3, 0x3, 0x92, 0x48335172, 0x80000000, 0x2, 0x7fa, 0x3]}, {0x0, 0x5, 0x2, [0x5, 0x0, 0x3, 0x10001, 0x41da, 0x930, 0x9, 0x200]}, {0x1, 0x0, 0x0, [0xfffffffc, 0x4, 0x7fffffff, 0xd6, 0x7fff, 0x80, 0xecb7, 0x1]}, {0x7ff, 0x200, 0x7f, [0x401, 0xbd, 0x200, 0x9, 0x200, 0xdda0, 0x7, 0x2]}]}) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:24 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48140000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x41) 12:32:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) [ 2522.731471] FAULT_INJECTION: forcing a failure. [ 2522.731471] name failslab, interval 1, probability 0, space 0, times 0 [ 2522.763075] CPU: 1 PID: 1806 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2522.770892] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2522.780238] Call Trace: [ 2522.782825] dump_stack+0x1b2/0x281 [ 2522.786454] should_fail.cold+0x10a/0x149 [ 2522.790610] should_failslab+0xd6/0x130 [ 2522.794589] __kmalloc+0x2c1/0x400 [ 2522.798127] ? kobject_get_path+0xb5/0x230 [ 2522.802360] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 2522.807809] kobject_get_path+0xb5/0x230 [ 2522.811870] kobject_uevent_env+0x230/0xf30 [ 2522.816209] ? wait_for_completion_io+0x10/0x10 [ 2522.820884] ? is_acpi_device_node+0x5b/0x70 [ 2522.825285] device_del+0x642/0xa80 [ 2522.828911] ? __device_links_no_driver+0x1b0/0x1b0 [ 2522.834103] device_unregister+0x22/0xc0 [ 2522.838162] bdi_unregister+0x42f/0x610 [ 2522.842137] ? wb_blkcg_offline+0x180/0x180 [ 2522.846464] del_gendisk+0x453/0x820 [ 2522.850434] ? refcount_dec_not_one+0x75/0xc0 [ 2522.854931] ? disk_events_poll_msecs_store+0x150/0x150 [ 2522.860290] ? wait_for_completion_io+0x10/0x10 [ 2522.864953] nbd_put.part.0+0xb0/0x140 [ 2522.868839] nbd_genl_connect+0xfa9/0x1400 [ 2522.873081] ? nbd_xmit_timeout+0x500/0x500 [ 2522.877399] ? validate_nla+0x192/0x5e0 12:32:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48140000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x41) [ 2522.881373] ? nla_parse+0x157/0x1f0 [ 2522.885090] genl_family_rcv_msg+0x572/0xb20 [ 2522.889495] ? genl_rcv+0x40/0x40 [ 2522.892944] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2522.898394] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2522.903509] ? trace_hardirqs_on+0x10/0x10 [ 2522.907755] genl_rcv_msg+0xaf/0x140 [ 2522.911465] netlink_rcv_skb+0x125/0x390 [ 2522.915523] ? genl_family_rcv_msg+0xb20/0xb20 [ 2522.920102] ? netlink_ack+0x9a0/0x9a0 [ 2522.923986] ? lock_acquire+0x170/0x3f0 [ 2522.927961] genl_rcv+0x24/0x40 12:32:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000040)) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) [ 2522.931234] netlink_unicast+0x437/0x610 [ 2522.935291] ? netlink_sendskb+0xd0/0xd0 [ 2522.939346] ? __check_object_size+0x179/0x230 [ 2522.943921] netlink_sendmsg+0x648/0xbc0 [ 2522.947980] ? nlmsg_notify+0x1b0/0x1b0 [ 2522.951946] ? kernel_recvmsg+0x210/0x210 [ 2522.956088] ? security_socket_sendmsg+0x83/0xb0 [ 2522.960838] ? nlmsg_notify+0x1b0/0x1b0 [ 2522.964802] sock_sendmsg+0xb5/0x100 [ 2522.968509] ___sys_sendmsg+0x6c8/0x800 [ 2522.972478] ? get_pid_task+0x91/0x130 [ 2522.976361] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2522.981112] ? lock_downgrade+0x740/0x740 [ 2522.985256] ? __fget+0x23e/0x3e0 [ 2522.988702] ? lock_acquire+0x170/0x3f0 [ 2522.992671] ? lock_downgrade+0x740/0x740 [ 2522.996817] ? __fget+0x265/0x3e0 [ 2523.000268] ? __fdget+0x19b/0x1f0 [ 2523.003802] ? sockfd_lookup_light+0xb2/0x160 [ 2523.008297] __sys_sendmsg+0xa3/0x120 [ 2523.012187] ? SyS_shutdown+0x160/0x160 [ 2523.016163] ? wait_for_completion_io+0x10/0x10 [ 2523.020833] ? SyS_read+0x210/0x210 [ 2523.024451] ? __do_page_fault+0x159/0xad0 [ 2523.028684] SyS_sendmsg+0x27/0x40 [ 2523.032218] ? __sys_sendmsg+0x120/0x120 [ 2523.036277] do_syscall_64+0x1d5/0x640 [ 2523.040161] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2523.045344] RIP: 0033:0x7fc05f6a20e9 [ 2523.049041] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2523.056744] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2523.064011] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2523.071273] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2523.078535] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2523.085798] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:24 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 6) 12:32:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000040)) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:24 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48140000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x41) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48140000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040011}, 0x41) (async) [ 2523.126864] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2523.152440] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2523.195257] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2523.216033] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2523.227641] FAULT_INJECTION: forcing a failure. [ 2523.227641] name failslab, interval 1, probability 0, space 0, times 0 [ 2523.239207] CPU: 0 PID: 1863 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2523.246997] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2523.256340] Call Trace: [ 2523.258917] dump_stack+0x1b2/0x281 [ 2523.262529] should_fail.cold+0x10a/0x149 [ 2523.266711] should_failslab+0xd6/0x130 [ 2523.270661] kmem_cache_alloc_node+0x263/0x410 [ 2523.275224] __alloc_skb+0x5c/0x510 [ 2523.278918] kobject_uevent_env+0x882/0xf30 [ 2523.283221] ? is_acpi_device_node+0x5b/0x70 [ 2523.287608] device_del+0x642/0xa80 [ 2523.291215] ? __device_links_no_driver+0x1b0/0x1b0 [ 2523.296207] device_unregister+0x22/0xc0 [ 2523.300264] bdi_unregister+0x42f/0x610 [ 2523.304215] ? wb_blkcg_offline+0x180/0x180 [ 2523.308529] del_gendisk+0x453/0x820 [ 2523.312227] ? refcount_dec_not_one+0x75/0xc0 [ 2523.316705] ? disk_events_poll_msecs_store+0x150/0x150 [ 2523.322053] ? wait_for_completion_io+0x10/0x10 [ 2523.326705] nbd_put.part.0+0xb0/0x140 [ 2523.330568] nbd_genl_connect+0xfa9/0x1400 [ 2523.334784] ? nbd_xmit_timeout+0x500/0x500 [ 2523.339085] ? validate_nla+0x192/0x5e0 [ 2523.343045] ? nla_parse+0x157/0x1f0 [ 2523.346750] genl_family_rcv_msg+0x572/0xb20 [ 2523.351228] ? genl_rcv+0x40/0x40 [ 2523.354657] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2523.360139] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2523.365218] ? trace_hardirqs_on+0x10/0x10 [ 2523.369438] genl_rcv_msg+0xaf/0x140 [ 2523.373146] netlink_rcv_skb+0x125/0x390 [ 2523.377184] ? genl_family_rcv_msg+0xb20/0xb20 [ 2523.381740] ? netlink_ack+0x9a0/0x9a0 [ 2523.385604] ? lock_acquire+0x170/0x3f0 [ 2523.389567] genl_rcv+0x24/0x40 [ 2523.392831] netlink_unicast+0x437/0x610 [ 2523.396869] ? netlink_sendskb+0xd0/0xd0 [ 2523.400908] ? __check_object_size+0x179/0x230 [ 2523.405468] netlink_sendmsg+0x648/0xbc0 [ 2523.409509] ? nlmsg_notify+0x1b0/0x1b0 [ 2523.413459] ? kernel_recvmsg+0x210/0x210 [ 2523.417588] ? security_socket_sendmsg+0x83/0xb0 [ 2523.422318] ? nlmsg_notify+0x1b0/0x1b0 [ 2523.426268] sock_sendmsg+0xb5/0x100 [ 2523.429960] ___sys_sendmsg+0x6c8/0x800 [ 2523.433922] ? get_pid_task+0x91/0x130 [ 2523.437796] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2523.442535] ? lock_downgrade+0x740/0x740 [ 2523.446674] ? __fget+0x23e/0x3e0 [ 2523.450125] ? lock_acquire+0x170/0x3f0 [ 2523.454087] ? lock_downgrade+0x740/0x740 [ 2523.458221] ? __fget+0x265/0x3e0 [ 2523.461664] ? __fdget+0x19b/0x1f0 [ 2523.465192] ? sockfd_lookup_light+0xb2/0x160 [ 2523.469667] __sys_sendmsg+0xa3/0x120 [ 2523.473451] ? SyS_shutdown+0x160/0x160 [ 2523.477410] ? wait_for_completion_io+0x10/0x10 [ 2523.482077] ? SyS_read+0x210/0x210 [ 2523.485691] ? __do_page_fault+0x159/0xad0 [ 2523.489909] SyS_sendmsg+0x27/0x40 [ 2523.493428] ? __sys_sendmsg+0x120/0x120 [ 2523.497470] do_syscall_64+0x1d5/0x640 [ 2523.501351] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2523.507388] RIP: 0033:0x7fc05f6a20e9 [ 2523.511082] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2523.518778] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2523.526143] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2523.533393] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2523.540641] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2523.547890] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:25 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="41000000005800fe8a0008"], 0x20}}, 0x0) 12:32:25 executing program 5: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r0, 0x5761, &(0x7f0000000000)={0x7, 0x0, [{0xdd9e, 0x2, 0x8, [0x9314, 0x2, 0x4, 0x0, 0x7, 0x6, 0x3, 0xa9]}, {0x401, 0x7, 0x8, [0xffd, 0xfff, 0x10000, 0xffffffff, 0x8, 0xab5, 0x5, 0xffff]}, {0x80, 0x6514, 0xf6, [0x2, 0x3, 0x60bb8246, 0x4, 0x3, 0xec1f, 0x4693, 0x8]}, {0x0, 0xa8000000, 0x1000, [0x3, 0x3, 0x92, 0x48335172, 0x80000000, 0x2, 0x7fa, 0x3]}, {0x0, 0x5, 0x2, [0x5, 0x0, 0x3, 0x10001, 0x41da, 0x930, 0x9, 0x200]}, {0x1, 0x0, 0x0, [0xfffffffc, 0x4, 0x7fffffff, 0xd6, 0x7fff, 0x80, 0xecb7, 0x1]}, {0x7ff, 0x200, 0x7f, [0x401, 0xbd, 0x200, 0x9, 0x200, 0xdda0, 0x7, 0x2]}]}) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}}, 0x0) 12:32:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000040)) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:25 executing program 4: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) setsockopt$inet6_dccp_buf(r0, 0x21, 0xd, &(0x7f00000001c0)="eee1762fc597f034f7dc887f982fa5b880949e3fcda056b49c610d3824bc9bc599a5d3a4a226007e1d5711589d159e6f687075f01cb37b0548154056", 0x3c) 12:32:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:25 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 7) [ 2523.589507] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={'syztnl2\x00', r1, 0x2f, 0x1, 0x80, 0x9, 0x42, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x700, 0x10, 0x1f}}) 12:32:25 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000200009b62e607a0000008800300daa109547243f8698229d41149e385fe9e7f51c4dc938bdaf3be275094fc2383640f25a0c16d29930dcfcd38d7408638e2053d0e74164700fd8383b016712d50e9c735e18c962413d423fa71cf3d8045eb1a3f792679618ee0a03c3da645b11d88a68dc5cca2b92188e62d4d4f36eccac4d5a3e833019c3b915fc7ee71f22d0585e63f60414741c55922012e243eaee483c21489b1104e1e4162bb41e84b7b25fe26be712c3dec096f276086d8a01b62b31674e5c27c7185341501b6045d92904cc218fcf2fe83461ec6fa317692d9813e4e5f05ddb6d931c6dc50c6897f79174c4c7d060367db7d5d918f2c49063dbd2847b48e8cd767ba56ff2e7ca8a80f85", @ANYRES32=r2], 0x1c}}, 0x0) 12:32:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:25 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="41000000005800fe8a0008"], 0x20}}, 0x0) [ 2523.687667] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:25 executing program 4: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) setsockopt$inet6_dccp_buf(r0, 0x21, 0xd, &(0x7f00000001c0)="eee1762fc597f034f7dc887f982fa5b880949e3fcda056b49c610d3824bc9bc599a5d3a4a226007e1d5711589d159e6f687075f01cb37b0548154056", 0x3c) 12:32:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={'syztnl2\x00', r1, 0x2f, 0x1, 0x80, 0x9, 0x42, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x700, 0x10, 0x1f}}) [ 2523.774654] FAULT_INJECTION: forcing a failure. [ 2523.774654] name failslab, interval 1, probability 0, space 0, times 0 [ 2523.797682] CPU: 0 PID: 1889 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2523.805497] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2523.819535] Call Trace: 12:32:25 executing program 4: ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) setsockopt$inet6_dccp_buf(r0, 0x21, 0xd, &(0x7f00000001c0)="eee1762fc597f034f7dc887f982fa5b880949e3fcda056b49c610d3824bc9bc599a5d3a4a226007e1d5711589d159e6f687075f01cb37b0548154056", 0x3c) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18}, './file0\x00'}) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x34, 0x0, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5, 0x21, 0x1}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_PW_TYPE={0x6}, @L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) setsockopt$inet6_dccp_buf(r0, 0x21, 0xd, &(0x7f00000001c0)="eee1762fc597f034f7dc887f982fa5b880949e3fcda056b49c610d3824bc9bc599a5d3a4a226007e1d5711589d159e6f687075f01cb37b0548154056", 0x3c) (async) [ 2523.822129] dump_stack+0x1b2/0x281 [ 2523.825762] should_fail.cold+0x10a/0x149 [ 2523.829913] should_failslab+0xd6/0x130 [ 2523.833895] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2523.839004] __kmalloc_node_track_caller+0x38/0x70 [ 2523.843934] __alloc_skb+0x96/0x510 [ 2523.847571] kobject_uevent_env+0x882/0xf30 [ 2523.851897] ? is_acpi_device_node+0x5b/0x70 [ 2523.856307] device_del+0x642/0xa80 [ 2523.859932] ? __device_links_no_driver+0x1b0/0x1b0 [ 2523.864974] device_unregister+0x22/0xc0 [ 2523.869036] bdi_unregister+0x42f/0x610 12:32:25 executing program 4: syz_open_dev$amidi(&(0x7f0000000000), 0x7, 0x10b041) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0xd28) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000040)=""/16, 0x10, 0x3, 0x0) read$midi(r0, &(0x7f0000000180)=""/221, 0xdd) socket$inet6_dccp(0xa, 0x6, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000280)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x16}, {[@timestamp={0x44, 0x14, 0x31, 0x0, 0x7, [0x0, 0x4, 0x9, 0x3f]}]}}}}}) 12:32:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000000), 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f0000000100)={'sit0\x00', &(0x7f0000000080)={'syztnl2\x00', r1, 0x2f, 0x1, 0x80, 0x9, 0x42, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast1, 0x700, 0x10, 0x1f}}) [ 2523.873131] ? wb_blkcg_offline+0x180/0x180 [ 2523.877632] del_gendisk+0x453/0x820 [ 2523.881344] ? refcount_dec_not_one+0x75/0xc0 [ 2523.885836] ? disk_events_poll_msecs_store+0x150/0x150 [ 2523.891205] ? wait_for_completion_io+0x10/0x10 [ 2523.895874] nbd_put.part.0+0xb0/0x140 [ 2523.899761] nbd_genl_connect+0xfa9/0x1400 [ 2523.903995] ? nbd_xmit_timeout+0x500/0x500 [ 2523.908314] ? validate_nla+0x192/0x5e0 [ 2523.912293] ? nla_parse+0x157/0x1f0 [ 2523.916004] genl_family_rcv_msg+0x572/0xb20 [ 2523.920413] ? genl_rcv+0x40/0x40 12:32:25 executing program 4: syz_open_dev$amidi(&(0x7f0000000000), 0x7, 0x10b041) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0xd28) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000040)=""/16, 0x10, 0x3, 0x0) read$midi(r0, &(0x7f0000000180)=""/221, 0xdd) socket$inet6_dccp(0xa, 0x6, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000280)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x16}, {[@timestamp={0x44, 0x14, 0x31, 0x0, 0x7, [0x0, 0x4, 0x9, 0x3f]}]}}}}}) syz_open_dev$amidi(&(0x7f0000000000), 0x7, 0x10b041) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0xd28) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) mq_timedreceive(r1, &(0x7f0000000040)=""/16, 0x10, 0x3, 0x0) (async) read$midi(r0, &(0x7f0000000180)=""/221, 0xdd) (async) socket$inet6_dccp(0xa, 0x6, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000280)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x16}, {[@timestamp={0x44, 0x14, 0x31, 0x0, 0x7, [0x0, 0x4, 0x9, 0x3f]}]}}}}}) (async) 12:32:25 executing program 4: syz_open_dev$amidi(&(0x7f0000000000), 0x7, 0x10b041) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0xd28) (async, rerun: 32) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 32) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) mq_timedreceive(r1, &(0x7f0000000040)=""/16, 0x10, 0x3, 0x0) read$midi(r0, &(0x7f0000000180)=""/221, 0xdd) (async, rerun: 64) socket$inet6_dccp(0xa, 0x6, 0x0) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000280)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x16}, {[@timestamp={0x44, 0x14, 0x31, 0x0, 0x7, [0x0, 0x4, 0x9, 0x3f]}]}}}}}) [ 2523.923869] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2523.929317] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2523.934417] ? trace_hardirqs_on+0x10/0x10 [ 2523.938657] genl_rcv_msg+0xaf/0x140 [ 2523.942374] netlink_rcv_skb+0x125/0x390 [ 2523.946439] ? genl_family_rcv_msg+0xb20/0xb20 [ 2523.951022] ? netlink_ack+0x9a0/0x9a0 [ 2523.954906] ? lock_acquire+0x170/0x3f0 [ 2523.958891] genl_rcv+0x24/0x40 [ 2523.962169] netlink_unicast+0x437/0x610 [ 2523.966232] ? netlink_sendskb+0xd0/0xd0 [ 2523.970292] ? __check_object_size+0x179/0x230 [ 2523.974873] netlink_sendmsg+0x648/0xbc0 [ 2523.978935] ? nlmsg_notify+0x1b0/0x1b0 [ 2523.982907] ? kernel_recvmsg+0x210/0x210 [ 2523.987052] ? security_socket_sendmsg+0x83/0xb0 [ 2523.991798] ? nlmsg_notify+0x1b0/0x1b0 [ 2523.995764] sock_sendmsg+0xb5/0x100 [ 2523.999469] ___sys_sendmsg+0x6c8/0x800 [ 2524.003435] ? get_pid_task+0x91/0x130 [ 2524.007317] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2524.012069] ? lock_downgrade+0x740/0x740 [ 2524.016211] ? __fget+0x23e/0x3e0 [ 2524.019660] ? lock_acquire+0x170/0x3f0 [ 2524.023632] ? lock_downgrade+0x740/0x740 [ 2524.027776] ? __fget+0x265/0x3e0 [ 2524.031227] ? __fdget+0x19b/0x1f0 [ 2524.034765] ? sockfd_lookup_light+0xb2/0x160 [ 2524.039250] __sys_sendmsg+0xa3/0x120 [ 2524.043032] ? SyS_shutdown+0x160/0x160 [ 2524.046986] ? wait_for_completion_io+0x10/0x10 [ 2524.051638] ? SyS_read+0x210/0x210 [ 2524.055246] ? __do_page_fault+0x159/0xad0 [ 2524.059459] SyS_sendmsg+0x27/0x40 [ 2524.062974] ? __sys_sendmsg+0x120/0x120 [ 2524.067014] do_syscall_64+0x1d5/0x640 [ 2524.070886] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2524.076063] RIP: 0033:0x7fc05f6a20e9 [ 2524.079759] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2524.087514] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2524.094767] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2524.102019] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2524.109275] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2524.116968] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:25 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 8) 12:32:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x200, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:25 executing program 4: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0xc481, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00000001140000000000009078e0000001ac14142683ffef3eaa07000000f8"]}) 12:32:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:25 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="41000000005800fe8a0008"], 0x20}}, 0x0) 12:32:25 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000200009b62e607a0000008800300daa109547243f8698229d41149e385fe9e7f51c4dc938bdaf3be275094fc2383640f25a0c16d29930dcfcd38d7408638e2053d0e74164700fd8383b016712d50e9c735e18c962413d423fa71cf3d8045eb1a3f792679618ee0a03c3da645b11d88a68dc5cca2b92188e62d4d4f36eccac4d5a3e833019c3b915fc7ee71f22d0585e63f60414741c55922012e243eaee483c21489b1104e1e4162bb41e84b7b25fe26be712c3dec096f276086d8a01b62b31674e5c27c7185341501b6045d92904cc218fcf2fe83461ec6fa317692d9813e4e5f05ddb6d931c6dc50c6897f79174c4c7d060367db7d5d918f2c49063dbd2847b48e8cd767ba56ff2e7ca8a80f85", @ANYRES32=r2], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000200009b62e607a0000008800300daa109547243f8698229d41149e385fe9e7f51c4dc938bdaf3be275094fc2383640f25a0c16d29930dcfcd38d7408638e2053d0e74164700fd8383b016712d50e9c735e18c962413d423fa71cf3d8045eb1a3f792679618ee0a03c3da645b11d88a68dc5cca2b92188e62d4d4f36eccac4d5a3e833019c3b915fc7ee71f22d0585e63f60414741c55922012e243eaee483c21489b1104e1e4162bb41e84b7b25fe26be712c3dec096f276086d8a01b62b31674e5c27c7185341501b6045d92904cc218fcf2fe83461ec6fa317692d9813e4e5f05ddb6d931c6dc50c6897f79174c4c7d060367db7d5d918f2c49063dbd2847b48e8cd767ba56ff2e7ca8a80f85", @ANYRES32=r2], 0x1c}}, 0x0) (async) 12:32:25 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:25 executing program 4: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0xc481, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x9) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00000001140000000000009078e0000001ac14142683ffef3eaa07000000f8"]}) [ 2524.249974] FAULT_INJECTION: forcing a failure. [ 2524.249974] name failslab, interval 1, probability 0, space 0, times 0 12:32:25 executing program 4: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0xc481, 0x0) ioctl$KVM_SET_NR_MMU_PAGES(r0, 0xae44, 0x9) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="00000001140000000000009078e0000001ac14142683ffef3eaa07000000f8"]}) 12:32:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2524.292211] CPU: 0 PID: 1960 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2524.300028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2524.309475] Call Trace: [ 2524.312065] dump_stack+0x1b2/0x281 [ 2524.320214] should_fail.cold+0x10a/0x149 [ 2524.324365] should_failslab+0xd6/0x130 [ 2524.328345] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2524.333453] __kmalloc_node+0x38/0x70 [ 2524.337260] blk_mq_alloc_tag_set+0x30f/0x910 12:32:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) (async) 12:32:25 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2524.341765] nbd_dev_add+0x2ae/0x800 [ 2524.345476] ? nbd_send_cmd+0x11f0/0x11f0 [ 2524.349623] ? ns_capable_common+0x127/0x150 [ 2524.354029] nbd_genl_connect+0x3a4/0x1400 [ 2524.358257] ? lock_acquire+0x170/0x3f0 [ 2524.362229] ? nbd_xmit_timeout+0x500/0x500 [ 2524.366547] ? validate_nla+0x192/0x5e0 [ 2524.370522] ? nla_parse+0x157/0x1f0 [ 2524.374239] genl_family_rcv_msg+0x572/0xb20 [ 2524.378738] ? genl_rcv+0x40/0x40 [ 2524.382190] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2524.387649] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2524.392748] ? trace_hardirqs_on+0x10/0x10 [ 2524.397013] genl_rcv_msg+0xaf/0x140 [ 2524.400728] netlink_rcv_skb+0x125/0x390 [ 2524.404786] ? genl_family_rcv_msg+0xb20/0xb20 [ 2524.409367] ? netlink_ack+0x9a0/0x9a0 [ 2524.413252] ? lock_acquire+0x170/0x3f0 [ 2524.417226] genl_rcv+0x24/0x40 [ 2524.420503] netlink_unicast+0x437/0x610 [ 2524.424557] ? netlink_sendskb+0xd0/0xd0 [ 2524.429048] ? __check_object_size+0x179/0x230 [ 2524.433626] netlink_sendmsg+0x648/0xbc0 [ 2524.437684] ? nlmsg_notify+0x1b0/0x1b0 [ 2524.441656] ? kernel_recvmsg+0x210/0x210 [ 2524.445802] ? security_socket_sendmsg+0x83/0xb0 [ 2524.450551] ? nlmsg_notify+0x1b0/0x1b0 [ 2524.454522] sock_sendmsg+0xb5/0x100 [ 2524.458361] ___sys_sendmsg+0x6c8/0x800 [ 2524.462332] ? get_pid_task+0x91/0x130 [ 2524.466215] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2524.470963] ? lock_downgrade+0x740/0x740 [ 2524.475093] ? __fget+0x23e/0x3e0 [ 2524.478538] ? lock_acquire+0x170/0x3f0 [ 2524.482500] ? lock_downgrade+0x740/0x740 [ 2524.486632] ? __fget+0x265/0x3e0 [ 2524.490070] ? __fdget+0x19b/0x1f0 [ 2524.493604] ? sockfd_lookup_light+0xb2/0x160 [ 2524.498079] __sys_sendmsg+0xa3/0x120 [ 2524.501862] ? SyS_shutdown+0x160/0x160 [ 2524.505815] ? wait_for_completion_io+0x10/0x10 [ 2524.510478] ? SyS_read+0x210/0x210 [ 2524.514090] ? __do_page_fault+0x159/0xad0 [ 2524.518302] SyS_sendmsg+0x27/0x40 [ 2524.521823] ? __sys_sendmsg+0x120/0x120 [ 2524.525895] do_syscall_64+0x1d5/0x640 [ 2524.529775] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2524.534944] RIP: 0033:0x7fc05f6a20e9 12:32:26 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 9) 12:32:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x200, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x200, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:26 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, 0x0, 0x700, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008000) 12:32:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x0, 0x4, 0x9, 0x1b, @loopback, @private0, 0x8000, 0x700, 0x7, 0x6}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', r1, 0x20, 0x1, 0x6, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @multicast1}}}}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6gre0\x00', r4, 0x29, 0x8, 0x8, 0x3, 0x4, @loopback, @remote, 0x7, 0x8080, 0x3, 0xdf}}) 12:32:26 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000200009b62e607a0000008800300daa109547243f8698229d41149e385fe9e7f51c4dc938bdaf3be275094fc2383640f25a0c16d29930dcfcd38d7408638e2053d0e74164700fd8383b016712d50e9c735e18c962413d423fa71cf3d8045eb1a3f792679618ee0a03c3da645b11d88a68dc5cca2b92188e62d4d4f36eccac4d5a3e833019c3b915fc7ee71f22d0585e63f60414741c55922012e243eaee483c21489b1104e1e4162bb41e84b7b25fe26be712c3dec096f276086d8a01b62b31674e5c27c7185341501b6045d92904cc218fcf2fe83461ec6fa317692d9813e4e5f05ddb6d931c6dc50c6897f79174c4c7d060367db7d5d918f2c49063dbd2847b48e8cd767ba56ff2e7ca8a80f85", @ANYRES32=r2], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000200009b62e607a0000008800300daa109547243f8698229d41149e385fe9e7f51c4dc938bdaf3be275094fc2383640f25a0c16d29930dcfcd38d7408638e2053d0e74164700fd8383b016712d50e9c735e18c962413d423fa71cf3d8045eb1a3f792679618ee0a03c3da645b11d88a68dc5cca2b92188e62d4d4f36eccac4d5a3e833019c3b915fc7ee71f22d0585e63f60414741c55922012e243eaee483c21489b1104e1e4162bb41e84b7b25fe26be712c3dec096f276086d8a01b62b31674e5c27c7185341501b6045d92904cc218fcf2fe83461ec6fa317692d9813e4e5f05ddb6d931c6dc50c6897f79174c4c7d060367db7d5d918f2c49063dbd2847b48e8cd767ba56ff2e7ca8a80f85", @ANYRES32=r2], 0x1c}}, 0x0) (async) 12:32:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x0, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2524.538630] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2524.546843] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2524.554097] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2524.561347] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2524.568598] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2524.575854] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2524.585307] nbd: failed to add new device 12:32:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x0, 0x4, 0x9, 0x1b, @loopback, @private0, 0x8000, 0x700, 0x7, 0x6}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', r1, 0x20, 0x1, 0x6, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @multicast1}}}}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6gre0\x00', r4, 0x29, 0x8, 0x8, 0x3, 0x4, @loopback, @remote, 0x7, 0x8080, 0x3, 0xdf}}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x0, 0x4, 0x9, 0x1b, @loopback, @private0, 0x8000, 0x700, 0x7, 0x6}}) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', r1, 0x20, 0x1, 0x6, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @multicast1}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6gre0\x00', r4, 0x29, 0x8, 0x8, 0x3, 0x4, @loopback, @remote, 0x7, 0x8080, 0x3, 0xdf}}) (async) 12:32:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x200, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x8044) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:26 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f0000000180)={'sit0\x00', 0x0, 0x4, 0x0, 0x4, 0x9, 0x1b, @loopback, @private0, 0x8000, 0x700, 0x7, 0x6}}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', r1, 0x20, 0x1, 0x6, 0x3, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @multicast1}}}}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r2, 0x89f4, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000000)={'ip6gre0\x00', r4, 0x29, 0x8, 0x8, 0x3, 0x4, @loopback, @remote, 0x7, 0x8080, 0x3, 0xdf}}) [ 2524.651305] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2524.666205] FAULT_INJECTION: forcing a failure. [ 2524.666205] name failslab, interval 1, probability 0, space 0, times 0 [ 2524.710206] CPU: 0 PID: 2019 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2524.718021] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2524.727372] Call Trace: [ 2524.729981] dump_stack+0x1b2/0x281 [ 2524.733610] should_fail.cold+0x10a/0x149 [ 2524.737754] should_failslab+0xd6/0x130 [ 2524.741725] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2524.746830] blk_mq_init_tags+0x5e/0x280 [ 2524.750891] blk_mq_alloc_rq_map+0x90/0x220 [ 2524.755231] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2524.759725] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2524.764218] nbd_dev_add+0x2ae/0x800 [ 2524.767947] ? nbd_send_cmd+0x11f0/0x11f0 [ 2524.772092] ? ns_capable_common+0x127/0x150 [ 2524.776500] nbd_genl_connect+0x3a4/0x1400 [ 2524.780733] ? lock_acquire+0x170/0x3f0 [ 2524.784705] ? nbd_xmit_timeout+0x500/0x500 [ 2524.789023] ? validate_nla+0x192/0x5e0 [ 2524.792989] ? nla_parse+0x157/0x1f0 [ 2524.796697] genl_family_rcv_msg+0x572/0xb20 [ 2524.801102] ? genl_rcv+0x40/0x40 [ 2524.804551] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2524.809999] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2524.815098] ? trace_hardirqs_on+0x10/0x10 [ 2524.819322] genl_rcv_msg+0xaf/0x140 [ 2524.823012] netlink_rcv_skb+0x125/0x390 [ 2524.827055] ? genl_family_rcv_msg+0xb20/0xb20 [ 2524.831621] ? netlink_ack+0x9a0/0x9a0 [ 2524.835483] ? lock_acquire+0x170/0x3f0 [ 2524.839433] genl_rcv+0x24/0x40 [ 2524.842697] netlink_unicast+0x437/0x610 [ 2524.846734] ? netlink_sendskb+0xd0/0xd0 [ 2524.850771] ? __check_object_size+0x179/0x230 [ 2524.855331] netlink_sendmsg+0x648/0xbc0 [ 2524.859368] ? nlmsg_notify+0x1b0/0x1b0 [ 2524.863319] ? kernel_recvmsg+0x210/0x210 [ 2524.867442] ? security_socket_sendmsg+0x83/0xb0 [ 2524.872174] ? nlmsg_notify+0x1b0/0x1b0 [ 2524.876124] sock_sendmsg+0xb5/0x100 [ 2524.879813] ___sys_sendmsg+0x6c8/0x800 [ 2524.883763] ? get_pid_task+0x91/0x130 [ 2524.887629] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2524.892362] ? lock_downgrade+0x740/0x740 [ 2524.896497] ? __fget+0x23e/0x3e0 [ 2524.899934] ? lock_acquire+0x170/0x3f0 [ 2524.903887] ? lock_downgrade+0x740/0x740 [ 2524.908011] ? __fget+0x265/0x3e0 [ 2524.911439] ? __fdget+0x19b/0x1f0 [ 2524.914959] ? sockfd_lookup_light+0xb2/0x160 [ 2524.919433] __sys_sendmsg+0xa3/0x120 [ 2524.923207] ? SyS_shutdown+0x160/0x160 [ 2524.927160] ? wait_for_completion_io+0x10/0x10 [ 2524.931807] ? SyS_read+0x210/0x210 [ 2524.935410] ? __do_page_fault+0x159/0xad0 [ 2524.939688] SyS_sendmsg+0x27/0x40 [ 2524.943209] ? __sys_sendmsg+0x120/0x120 [ 2524.947253] do_syscall_64+0x1d5/0x640 [ 2524.951121] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2524.956285] RIP: 0033:0x7fc05f6a20e9 [ 2524.959971] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2524.967651] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2524.974895] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2524.982141] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2524.989387] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2524.996631] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:26 executing program 4: r0 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x20000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x64, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xffff}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6a28}, @L2TP_ATTR_VLAN_ID={0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x20080}, 0x4786c3c60980d7c0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2525.008613] blk-mq: reduced tag depth (128 -> 64) 12:32:26 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 10) 12:32:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:26 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200c0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x16) r1 = getegid() seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2824096, &(0x7f0000000100)={{}, 0x2c, {'rootmode', 0x3d, 0xda22dfcad81dc949}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x40e}}], [{@smackfsroot}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x14000) r4 = getegid() syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x0, 0x0, 0x0, 0x800000, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x101}}, {@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other}, {@allow_other}, {@blksize}], [{@context={'context', 0x3d, 'system_u'}}, {@measure}, {@smackfstransmute={'smackfstransmute', 0x3d, 'blksize'}}, {@obj_role={'obj_role', 0x3d, 'rootmode'}}]}}) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000000), 0xfffffffffffffebd) 12:32:26 executing program 4: r0 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x20000000}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x64, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xffff}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6a28}, @L2TP_ATTR_VLAN_ID={0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x20080}, 0x4786c3c60980d7c0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) epoll_create1(0x80000) (async) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x20000000}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x64, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xffff}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6a28}, @L2TP_ATTR_VLAN_ID={0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x20080}, 0x4786c3c60980d7c0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) [ 2525.061200] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2525.085695] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. 12:32:26 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, 0x0, 0x700, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008000) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, 0x0, 0x700, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008000) (async) 12:32:26 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:26 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x44010) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x20008811) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r7], 0x1c}}, 0x0) [ 2525.135005] FAULT_INJECTION: forcing a failure. [ 2525.135005] name failslab, interval 1, probability 0, space 0, times 0 [ 2525.161756] audit: type=1326 audit(1652272346.722:154): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2072 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f159b87b0e9 code=0x0 [ 2525.181724] CPU: 0 PID: 2073 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2525.189593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2525.198940] Call Trace: [ 2525.201525] dump_stack+0x1b2/0x281 [ 2525.205158] should_fail.cold+0x10a/0x149 [ 2525.209306] should_failslab+0xd6/0x130 [ 2525.213279] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2525.218470] __kmalloc_node+0x38/0x70 [ 2525.222268] sbitmap_init_node+0x10c/0x3d0 [ 2525.226500] sbitmap_queue_init_node+0x37/0x5d0 [ 2525.231166] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 2525.236178] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 2525.241453] blk_mq_init_tags+0xf4/0x280 [ 2525.245514] blk_mq_alloc_rq_map+0x90/0x220 [ 2525.249833] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2525.254328] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2525.258819] nbd_dev_add+0x2ae/0x800 [ 2525.262516] ? nbd_send_cmd+0x11f0/0x11f0 [ 2525.266642] ? ns_capable_common+0x127/0x150 [ 2525.271028] nbd_genl_connect+0x3a4/0x1400 [ 2525.275239] ? lock_acquire+0x170/0x3f0 [ 2525.279193] ? nbd_xmit_timeout+0x500/0x500 [ 2525.283506] ? validate_nla+0x192/0x5e0 [ 2525.287462] ? nla_parse+0x157/0x1f0 [ 2525.291594] genl_family_rcv_msg+0x572/0xb20 [ 2525.295988] ? genl_rcv+0x40/0x40 [ 2525.299422] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2525.304860] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2525.309952] ? trace_hardirqs_on+0x10/0x10 [ 2525.314183] genl_rcv_msg+0xaf/0x140 [ 2525.317894] netlink_rcv_skb+0x125/0x390 [ 2525.321948] ? genl_family_rcv_msg+0xb20/0xb20 [ 2525.326525] ? netlink_ack+0x9a0/0x9a0 [ 2525.330403] ? lock_acquire+0x170/0x3f0 [ 2525.334618] genl_rcv+0x24/0x40 [ 2525.337883] netlink_unicast+0x437/0x610 [ 2525.342022] ? netlink_sendskb+0xd0/0xd0 [ 2525.346063] ? __check_object_size+0x179/0x230 [ 2525.350634] netlink_sendmsg+0x648/0xbc0 [ 2525.354679] ? nlmsg_notify+0x1b0/0x1b0 [ 2525.358636] ? kernel_recvmsg+0x210/0x210 [ 2525.362765] ? security_socket_sendmsg+0x83/0xb0 [ 2525.367495] ? nlmsg_notify+0x1b0/0x1b0 [ 2525.371451] sock_sendmsg+0xb5/0x100 [ 2525.375160] ___sys_sendmsg+0x6c8/0x800 [ 2525.379119] ? get_pid_task+0x91/0x130 [ 2525.382992] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2525.387729] ? lock_downgrade+0x740/0x740 [ 2525.391858] ? __fget+0x23e/0x3e0 [ 2525.395287] ? lock_acquire+0x170/0x3f0 [ 2525.399236] ? lock_downgrade+0x740/0x740 [ 2525.403361] ? __fget+0x265/0x3e0 [ 2525.406792] ? __fdget+0x19b/0x1f0 [ 2525.410313] ? sockfd_lookup_light+0xb2/0x160 [ 2525.414802] __sys_sendmsg+0xa3/0x120 [ 2525.418597] ? SyS_shutdown+0x160/0x160 [ 2525.422557] ? wait_for_completion_io+0x10/0x10 [ 2525.427220] ? SyS_read+0x210/0x210 [ 2525.430826] ? __do_page_fault+0x159/0xad0 [ 2525.435050] SyS_sendmsg+0x27/0x40 [ 2525.438565] ? __sys_sendmsg+0x120/0x120 [ 2525.442604] do_syscall_64+0x1d5/0x640 [ 2525.446478] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2525.451644] RIP: 0033:0x7fc05f6a20e9 [ 2525.455331] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2525.463025] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2525.470277] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2525.477521] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2525.484771] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2525.492022] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2525.502072] blk-mq: reduced tag depth (128 -> 64) 12:32:27 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x5c, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:27 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, 0x0, 0x700, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008000) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x6c, 0x0, 0x700, 0x70bd2d, 0x25dfdbff, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x9}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xffff}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_STATUS={0x5}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x44001}, 0x20008000) (async) 12:32:27 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) (rerun: 32) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x44010) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x20008811) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r7], 0x1c}}, 0x0) 12:32:27 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 11) 12:32:27 executing program 4: r0 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, 0xffffffffffffffff, &(0x7f0000000000)={0x20000000}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x64, r4, 0x800, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_DEBUG={0x8, 0x11, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @private1={0xfc, 0x1, '\x00', 0x1}}, @L2TP_ATTR_MTU={0x6, 0x1c, 0x40}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xffff}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x6a28}, @L2TP_ATTR_VLAN_ID={0x6}]}, 0x64}, 0x1, 0x0, 0x0, 0x20080}, 0x4786c3c60980d7c0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2525.622889] FAULT_INJECTION: forcing a failure. [ 2525.622889] name failslab, interval 1, probability 0, space 0, times 0 [ 2525.642331] CPU: 1 PID: 2122 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2525.650151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2525.659497] Call Trace: [ 2525.662080] dump_stack+0x1b2/0x281 [ 2525.665709] should_fail.cold+0x10a/0x149 [ 2525.669854] should_failslab+0xd6/0x130 [ 2525.673830] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2525.678931] sbitmap_queue_init_node+0x27f/0x5d0 [ 2525.683684] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 2525.688960] blk_mq_init_tags+0xf4/0x280 [ 2525.693023] blk_mq_alloc_rq_map+0x90/0x220 [ 2525.697348] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2525.701854] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2525.706357] nbd_dev_add+0x2ae/0x800 [ 2525.710067] ? nbd_send_cmd+0x11f0/0x11f0 [ 2525.714209] ? ns_capable_common+0x127/0x150 [ 2525.718615] nbd_genl_connect+0x3a4/0x1400 [ 2525.722835] ? lock_acquire+0x170/0x3f0 [ 2525.726796] ? nbd_xmit_timeout+0x500/0x500 [ 2525.731109] ? validate_nla+0x192/0x5e0 [ 2525.735075] ? nla_parse+0x157/0x1f0 [ 2525.738792] genl_family_rcv_msg+0x572/0xb20 [ 2525.743198] ? genl_rcv+0x40/0x40 [ 2525.746654] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2525.752093] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2525.757180] ? trace_hardirqs_on+0x10/0x10 [ 2525.761398] genl_rcv_msg+0xaf/0x140 [ 2525.765096] netlink_rcv_skb+0x125/0x390 [ 2525.769141] ? genl_family_rcv_msg+0xb20/0xb20 [ 2525.773696] ? netlink_ack+0x9a0/0x9a0 [ 2525.777561] ? lock_acquire+0x170/0x3f0 [ 2525.781513] genl_rcv+0x24/0x40 [ 2525.784884] netlink_unicast+0x437/0x610 [ 2525.789098] ? netlink_sendskb+0xd0/0xd0 [ 2525.793135] ? __check_object_size+0x179/0x230 [ 2525.797695] netlink_sendmsg+0x648/0xbc0 [ 2525.801739] ? nlmsg_notify+0x1b0/0x1b0 [ 2525.805690] ? kernel_recvmsg+0x210/0x210 [ 2525.809817] ? security_socket_sendmsg+0x83/0xb0 [ 2525.814558] ? nlmsg_notify+0x1b0/0x1b0 [ 2525.818514] sock_sendmsg+0xb5/0x100 [ 2525.822203] ___sys_sendmsg+0x6c8/0x800 [ 2525.826165] ? get_pid_task+0x91/0x130 [ 2525.830026] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2525.834757] ? lock_downgrade+0x740/0x740 [ 2525.838887] ? __fget+0x23e/0x3e0 [ 2525.842317] ? lock_acquire+0x170/0x3f0 [ 2525.846271] ? lock_downgrade+0x740/0x740 [ 2525.850406] ? __fget+0x265/0x3e0 [ 2525.853841] ? __fdget+0x19b/0x1f0 [ 2525.857360] ? sockfd_lookup_light+0xb2/0x160 [ 2525.861830] __sys_sendmsg+0xa3/0x120 [ 2525.865607] ? SyS_shutdown+0x160/0x160 [ 2525.869561] ? wait_for_completion_io+0x10/0x10 [ 2525.874211] ? SyS_read+0x210/0x210 [ 2525.877822] ? __do_page_fault+0x159/0xad0 [ 2525.882038] SyS_sendmsg+0x27/0x40 [ 2525.885559] ? __sys_sendmsg+0x120/0x120 [ 2525.889613] do_syscall_64+0x1d5/0x640 [ 2525.893485] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2525.898653] RIP: 0033:0x7fc05f6a20e9 [ 2525.902339] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2525.910023] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2525.917269] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 12:32:27 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200c0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x16) r1 = getegid() seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) (async) socket$l2tp(0x2, 0x2, 0x73) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2824096, &(0x7f0000000100)={{}, 0x2c, {'rootmode', 0x3d, 0xda22dfcad81dc949}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x40e}}], [{@smackfsroot}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x14000) (async) r4 = getegid() syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x0, 0x0, 0x0, 0x800000, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x101}}, {@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other}, {@allow_other}, {@blksize}], [{@context={'context', 0x3d, 'system_u'}}, {@measure}, {@smackfstransmute={'smackfstransmute', 0x3d, 'blksize'}}, {@obj_role={'obj_role', 0x3d, 'rootmode'}}]}}) (async) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000000), 0xfffffffffffffebd) [ 2525.924517] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2525.931766] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2525.939015] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2525.948816] blk-mq: reduced tag depth (128 -> 64) 12:32:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x19, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @local, {[@timestamp_addr={0x44, 0x4, 0x85, 0x1, 0xa}, @cipso={0x86, 0x25, 0x1, [{0x0, 0x3, "11"}, {0x2, 0x6, "bf5d6c07"}, {0x2, 0x10, "035c014f5b6c3e362c5b9e29ac8c"}, {0x7, 0x6, "c8641e38"}]}, @timestamp_prespec={0x44, 0x24, 0x39, 0x3, 0xa, [{@private=0xa010100, 0x1}, {@empty, 0x400}, {@multicast2, 0x9}, {@rand_addr=0x64010102}]}, @noop]}}}}}) 12:32:27 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}]}, 0x50}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:27 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 12) 12:32:27 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'erspan0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x20, 0x1, 0x1, 0x10001, {{0x27, 0x4, 0x2, 0x9, 0x9c, 0x68, 0x0, 0x7f, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@rr={0x7, 0x13, 0xf8, [@empty, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @end, @ssrr={0x89, 0x17, 0xc9, [@remote, @remote, @multicast1, @broadcast, @private=0xa010100]}, @rr={0x7, 0x27, 0x43, [@local, @local, @multicast1, @remote, @broadcast, @remote, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x36}]}, @cipso={0x86, 0x2a, 0x3, [{0x6, 0x6, "2cb0e316"}, {0x1, 0xa, "4b003fbe1e7b0633"}, {0x2, 0xd, "e971b91c5b045376c76844"}, {0x5, 0x7, "ef926ae4c2"}]}, @lsrr={0x83, 0xb, 0xf4, [@multicast1, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x4c, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xd5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x81}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x10008884) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000440)={'syztnl2\x00', r6, 0x4, 0x9, 0x26, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, 0x8, 0x40, 0x4, 0x80000001}}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r1, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x15}, 0x8000) 12:32:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x19, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @local, {[@timestamp_addr={0x44, 0x4, 0x85, 0x1, 0xa}, @cipso={0x86, 0x25, 0x1, [{0x0, 0x3, "11"}, {0x2, 0x6, "bf5d6c07"}, {0x2, 0x10, "035c014f5b6c3e362c5b9e29ac8c"}, {0x7, 0x6, "c8641e38"}]}, @timestamp_prespec={0x44, 0x24, 0x39, 0x3, 0xa, [{@private=0xa010100, 0x1}, {@empty, 0x400}, {@multicast2, 0x9}, {@rand_addr=0x64010102}]}, @noop]}}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x19, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @local, {[@timestamp_addr={0x44, 0x4, 0x85, 0x1, 0xa}, @cipso={0x86, 0x25, 0x1, [{0x0, 0x3, "11"}, {0x2, 0x6, "bf5d6c07"}, {0x2, 0x10, "035c014f5b6c3e362c5b9e29ac8c"}, {0x7, 0x6, "c8641e38"}]}, @timestamp_prespec={0x44, 0x24, 0x39, 0x3, 0xa, [{@private=0xa010100, 0x1}, {@empty, 0x400}, {@multicast2, 0x9}, {@rand_addr=0x64010102}]}, @noop]}}}}}) (async) [ 2526.066675] FAULT_INJECTION: forcing a failure. [ 2526.066675] name failslab, interval 1, probability 0, space 0, times 0 [ 2526.082187] audit: type=1326 audit(1652272347.642:155): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2149 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f159b87b0e9 code=0x0 [ 2526.089229] CPU: 0 PID: 2162 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2526.110019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2526.119365] Call Trace: [ 2526.121952] dump_stack+0x1b2/0x281 [ 2526.125581] should_fail.cold+0x10a/0x149 [ 2526.129731] should_failslab+0xd6/0x130 [ 2526.133712] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2526.138818] sbitmap_queue_init_node+0x27f/0x5d0 [ 2526.143571] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 2526.148845] blk_mq_init_tags+0x14b/0x280 [ 2526.152992] blk_mq_alloc_rq_map+0x90/0x220 [ 2526.157312] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2526.161811] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2526.166304] nbd_dev_add+0x2ae/0x800 [ 2526.170029] ? nbd_send_cmd+0x11f0/0x11f0 [ 2526.174174] ? ns_capable_common+0x127/0x150 [ 2526.178581] nbd_genl_connect+0x3a4/0x1400 [ 2526.182811] ? lock_acquire+0x170/0x3f0 [ 2526.186782] ? nbd_xmit_timeout+0x500/0x500 [ 2526.191098] ? validate_nla+0x192/0x5e0 [ 2526.195065] ? nla_parse+0x157/0x1f0 [ 2526.198773] genl_family_rcv_msg+0x572/0xb20 [ 2526.203170] ? genl_rcv+0x40/0x40 [ 2526.206607] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2526.212039] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2526.217122] ? trace_hardirqs_on+0x10/0x10 [ 2526.221340] genl_rcv_msg+0xaf/0x140 [ 2526.225034] netlink_rcv_skb+0x125/0x390 [ 2526.229080] ? genl_family_rcv_msg+0xb20/0xb20 [ 2526.233639] ? netlink_ack+0x9a0/0x9a0 [ 2526.237500] ? lock_acquire+0x170/0x3f0 [ 2526.241455] genl_rcv+0x24/0x40 [ 2526.244718] netlink_unicast+0x437/0x610 [ 2526.248757] ? netlink_sendskb+0xd0/0xd0 [ 2526.252795] ? __check_object_size+0x179/0x230 [ 2526.257355] netlink_sendmsg+0x648/0xbc0 [ 2526.261394] ? nlmsg_notify+0x1b0/0x1b0 [ 2526.265344] ? kernel_recvmsg+0x210/0x210 [ 2526.269471] ? security_socket_sendmsg+0x83/0xb0 [ 2526.274200] ? nlmsg_notify+0x1b0/0x1b0 [ 2526.278154] sock_sendmsg+0xb5/0x100 [ 2526.281845] ___sys_sendmsg+0x6c8/0x800 [ 2526.285807] ? get_pid_task+0x91/0x130 [ 2526.289683] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2526.294417] ? lock_downgrade+0x740/0x740 [ 2526.298541] ? __fget+0x23e/0x3e0 [ 2526.301969] ? lock_acquire+0x170/0x3f0 [ 2526.305933] ? lock_downgrade+0x740/0x740 [ 2526.310058] ? __fget+0x265/0x3e0 [ 2526.313499] ? __fdget+0x19b/0x1f0 [ 2526.317023] ? sockfd_lookup_light+0xb2/0x160 [ 2526.321494] __sys_sendmsg+0xa3/0x120 [ 2526.325285] ? SyS_shutdown+0x160/0x160 [ 2526.329244] ? wait_for_completion_io+0x10/0x10 [ 2526.333898] ? SyS_read+0x210/0x210 [ 2526.337505] ? __do_page_fault+0x159/0xad0 [ 2526.341732] SyS_sendmsg+0x27/0x40 [ 2526.345251] ? __sys_sendmsg+0x120/0x120 [ 2526.349297] do_syscall_64+0x1d5/0x640 [ 2526.353168] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2526.358338] RIP: 0033:0x7fc05f6a20e9 12:32:27 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x19, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @local, {[@timestamp_addr={0x44, 0x4, 0x85, 0x1, 0xa}, @cipso={0x86, 0x25, 0x1, [{0x0, 0x3, "11"}, {0x2, 0x6, "bf5d6c07"}, {0x2, 0x10, "035c014f5b6c3e362c5b9e29ac8c"}, {0x7, 0x6, "c8641e38"}]}, @timestamp_prespec={0x44, 0x24, 0x39, 0x3, 0xa, [{@private=0xa010100, 0x1}, {@empty, 0x400}, {@multicast2, 0x9}, {@rand_addr=0x64010102}]}, @noop]}}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x19, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=0x64010102, @local, {[@timestamp_addr={0x44, 0x4, 0x85, 0x1, 0xa}, @cipso={0x86, 0x25, 0x1, [{0x0, 0x3, "11"}, {0x2, 0x6, "bf5d6c07"}, {0x2, 0x10, "035c014f5b6c3e362c5b9e29ac8c"}, {0x7, 0x6, "c8641e38"}]}, @timestamp_prespec={0x44, 0x24, 0x39, 0x3, 0xa, [{@private=0xa010100, 0x1}, {@empty, 0x400}, {@multicast2, 0x9}, {@rand_addr=0x64010102}]}, @noop]}}}}}) (async) 12:32:28 executing program 4: sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}}, 0xc0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@cipso={0x86, 0x6, 0x1}, @rr={0x7, 0xb, 0xfe, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) [ 2526.362029] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2526.369715] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2526.376973] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2526.384232] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2526.391504] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2526.398755] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2526.410695] blk-mq: reduced tag depth (128 -> 64) 12:32:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x50, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}]}, 0x50}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:28 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x44010) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x20008811) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r7], 0x1c}}, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), 0xffffffffffffffff) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r3) (async) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_GETPARAMS(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, r4, 0x1, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r5}]}, 0x1c}}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r2, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r1, 0x400, 0x70bd2c, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44800}, 0x44010) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r2, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan1\x00'}) (async) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x30, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5, 0x2b, 0x2}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r6}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x20008811) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r7], 0x1c}}, 0x0) (async) 12:32:28 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 13) 12:32:28 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'erspan0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x20, 0x1, 0x1, 0x10001, {{0x27, 0x4, 0x2, 0x9, 0x9c, 0x68, 0x0, 0x7f, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@rr={0x7, 0x13, 0xf8, [@empty, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @end, @ssrr={0x89, 0x17, 0xc9, [@remote, @remote, @multicast1, @broadcast, @private=0xa010100]}, @rr={0x7, 0x27, 0x43, [@local, @local, @multicast1, @remote, @broadcast, @remote, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x36}]}, @cipso={0x86, 0x2a, 0x3, [{0x6, 0x6, "2cb0e316"}, {0x1, 0xa, "4b003fbe1e7b0633"}, {0x2, 0xd, "e971b91c5b045376c76844"}, {0x5, 0x7, "ef926ae4c2"}]}, @lsrr={0x83, 0xb, 0xf4, [@multicast1, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x4c, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xd5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x81}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x10008884) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000440)={'syztnl2\x00', r6, 0x4, 0x9, 0x26, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, 0x8, 0x40, 0x4, 0x80000001}}) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r1, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x15}, 0x8000) [ 2526.529702] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. [ 2526.545136] FAULT_INJECTION: forcing a failure. [ 2526.545136] name failslab, interval 1, probability 0, space 0, times 0 [ 2526.565292] CPU: 0 PID: 2200 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2526.573200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2526.582548] Call Trace: [ 2526.585139] dump_stack+0x1b2/0x281 [ 2526.588771] should_fail.cold+0x10a/0x149 [ 2526.592920] should_failslab+0xd6/0x130 [ 2526.596893] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2526.601995] __kmalloc_node+0x38/0x70 [ 2526.605794] blk_mq_alloc_rq_map+0xd2/0x220 [ 2526.610115] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2526.614612] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2526.619112] nbd_dev_add+0x2ae/0x800 [ 2526.622822] ? nbd_send_cmd+0x11f0/0x11f0 [ 2526.626966] ? ns_capable_common+0x127/0x150 [ 2526.631372] nbd_genl_connect+0x3a4/0x1400 [ 2526.635598] ? lock_acquire+0x170/0x3f0 [ 2526.639568] ? nbd_xmit_timeout+0x500/0x500 [ 2526.643884] ? validate_nla+0x192/0x5e0 [ 2526.647845] ? nla_parse+0x157/0x1f0 [ 2526.651536] genl_family_rcv_msg+0x572/0xb20 [ 2526.655922] ? genl_rcv+0x40/0x40 [ 2526.659353] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2526.664784] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2526.669872] ? trace_hardirqs_on+0x10/0x10 [ 2526.674096] genl_rcv_msg+0xaf/0x140 [ 2526.677787] netlink_rcv_skb+0x125/0x390 [ 2526.681824] ? genl_family_rcv_msg+0xb20/0xb20 [ 2526.686382] ? netlink_ack+0x9a0/0x9a0 [ 2526.690245] ? lock_acquire+0x170/0x3f0 [ 2526.694199] genl_rcv+0x24/0x40 [ 2526.697453] netlink_unicast+0x437/0x610 [ 2526.701498] ? netlink_sendskb+0xd0/0xd0 [ 2526.705542] ? __check_object_size+0x179/0x230 [ 2526.710101] netlink_sendmsg+0x648/0xbc0 [ 2526.714138] ? nlmsg_notify+0x1b0/0x1b0 [ 2526.718087] ? kernel_recvmsg+0x210/0x210 [ 2526.722220] ? security_socket_sendmsg+0x83/0xb0 [ 2526.726956] ? nlmsg_notify+0x1b0/0x1b0 [ 2526.730906] sock_sendmsg+0xb5/0x100 [ 2526.734600] ___sys_sendmsg+0x6c8/0x800 [ 2526.738550] ? get_pid_task+0x91/0x130 [ 2526.742421] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2526.747157] ? lock_downgrade+0x740/0x740 [ 2526.751280] ? __fget+0x23e/0x3e0 [ 2526.754711] ? lock_acquire+0x170/0x3f0 [ 2526.758660] ? lock_downgrade+0x740/0x740 [ 2526.762784] ? __fget+0x265/0x3e0 [ 2526.766212] ? __fdget+0x19b/0x1f0 [ 2526.769729] ? sockfd_lookup_light+0xb2/0x160 [ 2526.774199] __sys_sendmsg+0xa3/0x120 [ 2526.777974] ? SyS_shutdown+0x160/0x160 [ 2526.781927] ? wait_for_completion_io+0x10/0x10 [ 2526.786587] ? SyS_read+0x210/0x210 [ 2526.790197] ? __do_page_fault+0x159/0xad0 [ 2526.794407] SyS_sendmsg+0x27/0x40 [ 2526.797919] ? __sys_sendmsg+0x120/0x120 [ 2526.801961] do_syscall_64+0x1d5/0x640 [ 2526.805827] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2526.810992] RIP: 0033:0x7fc05f6a20e9 [ 2526.814676] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2526.822357] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 12:32:28 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200c0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x16) r1 = getegid() seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) socket$l2tp(0x2, 0x2, 0x73) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2824096, &(0x7f0000000100)={{}, 0x2c, {'rootmode', 0x3d, 0xda22dfcad81dc949}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x40e}}], [{@smackfsroot}]}}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x14000) r4 = getegid() syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x0, 0x0, 0x0, 0x800000, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x101}}, {@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other}, {@allow_other}, {@blksize}], [{@context={'context', 0x3d, 'system_u'}}, {@measure}, {@smackfstransmute={'smackfstransmute', 0x3d, 'blksize'}}, {@obj_role={'obj_role', 0x3d, 'rootmode'}}]}}) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000000), 0xfffffffffffffebd) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2200c0, 0x0) (async) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x16) (async) getegid() (async) seccomp$SECCOMP_SET_MODE_STRICT(0x0, 0x0, 0x0) (async) socket$l2tp(0x2, 0x2, 0x73) (async) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x2824096, &(0x7f0000000100)={{}, 0x2c, {'rootmode', 0x3d, 0xda22dfcad81dc949}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1600}}, {@max_read={'max_read', 0x3d, 0x40e}}], [{@smackfsroot}]}}) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$mice(0xffffffffffffff9c, &(0x7f0000000280), 0x14000) (async) getegid() (async) syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x0, 0x0, 0x0, 0x800000, &(0x7f00000002c0)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x101}}, {@max_read={'max_read', 0x3d, 0x1}}, {@blksize={'blksize', 0x3d, 0x1400}}, {@max_read={'max_read', 0x3d, 0x5}}, {@allow_other}, {@allow_other}, {@blksize}], [{@context={'context', 0x3d, 'system_u'}}, {@measure}, {@smackfstransmute={'smackfstransmute', 0x3d, 'blksize'}}, {@obj_role={'obj_role', 0x3d, 'rootmode'}}]}}) (async) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f0000000000), 0xfffffffffffffebd) (async) 12:32:28 executing program 4: sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}}, 0xc0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@cipso={0x86, 0x6, 0x1}, @rr={0x7, 0xb, 0xfe, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) 12:32:28 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'erspan0\x00', &(0x7f0000000340)={'ip_vti0\x00', 0x0, 0x20, 0x1, 0x1, 0x10001, {{0x27, 0x4, 0x2, 0x9, 0x9c, 0x68, 0x0, 0x7f, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@rr={0x7, 0x13, 0xf8, [@empty, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}, @end, @ssrr={0x89, 0x17, 0xc9, [@remote, @remote, @multicast1, @broadcast, @private=0xa010100]}, @rr={0x7, 0x27, 0x43, [@local, @local, @multicast1, @remote, @broadcast, @remote, @broadcast, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x36}]}, @cipso={0x86, 0x2a, 0x3, [{0x6, 0x6, "2cb0e316"}, {0x1, 0xa, "4b003fbe1e7b0633"}, {0x2, 0xd, "e971b91c5b045376c76844"}, {0x5, 0x7, "ef926ae4c2"}]}, @lsrr={0x83, 0xb, 0xf4, [@multicast1, @multicast2]}]}}}}}) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000200}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)={0x4c, 0x0, 0x400, 0x70bd29, 0x25dfdbfc, {}, [@BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0xd5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x81}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r2}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8010}, 0x10008884) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async, rerun: 64) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000004c0)={'sit0\x00', &(0x7f0000000440)={'syztnl2\x00', r6, 0x4, 0x9, 0x26, 0x5, 0x20, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @loopback, 0x8, 0x40, 0x4, 0x80000001}}) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, r1, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_COOKIE={0xc, 0xf, 0x4}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x15}, 0x8000) [ 2526.829602] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2526.836850] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2526.844095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2526.851338] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2526.860613] blk-mq: reduced tag depth (128 -> 64) 12:32:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:28 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 14) [ 2526.916345] audit: type=1326 audit(1652272348.482:156): auid=4294967295 uid=0 gid=0 ses=4294967295 pid=2224 comm="syz-executor.0" exe="/root/syz-executor.0" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f159b87b0e9 code=0x0 12:32:28 executing program 4: sendmsg$IEEE802154_LLSEC_LIST_KEY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x400, 0x70bd29, 0x25dfdbfe, {}, ["", "", "", "", "", ""]}, 0x14}}, 0xc0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@cipso={0x86, 0x6, 0x1}, @rr={0x7, 0xb, 0xfe, [@empty, @initdev={0xac, 0x1e, 0x0, 0x0}]}]}}}}}) 12:32:28 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="99f52869062258bdb529202c000000", @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf250700000008000300", @ANYRES32=0x0, @ANYBLOB="05003000000000000800390009000000"], 0x2c}}, 0x800) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:28 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:28 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r1) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_DISASSOCIATE_REQ(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_REASON={0x5, 0x12, 0x4}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_REASON={0x5, 0x12, 0xcc}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_DISASSOCIATE_REQ(r5, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4085}, 0x8000) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="6332a79098f18d1f23010026f330e426ecd2b85d4e", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 12:32:28 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0xef, 0x9, 0x3, @loopback, @mcast2, 0x700, 0x7, 0x1}}) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x442082, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000080)=0x2, 0x4) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000180)) [ 2527.003588] FAULT_INJECTION: forcing a failure. [ 2527.003588] name failslab, interval 1, probability 0, space 0, times 0 [ 2527.033599] CPU: 1 PID: 2245 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2527.041412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2527.050780] Call Trace: [ 2527.053381] dump_stack+0x1b2/0x281 [ 2527.057010] should_fail.cold+0x10a/0x149 [ 2527.061155] should_failslab+0xd6/0x130 [ 2527.065128] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2527.070230] __kmalloc_node+0x38/0x70 [ 2527.074028] blk_mq_alloc_rq_map+0x113/0x220 [ 2527.078437] __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2527.082928] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2527.087425] nbd_dev_add+0x2ae/0x800 [ 2527.091133] ? nbd_send_cmd+0x11f0/0x11f0 [ 2527.095276] ? ns_capable_common+0x127/0x150 [ 2527.099683] nbd_genl_connect+0x3a4/0x1400 [ 2527.103914] ? lock_acquire+0x170/0x3f0 [ 2527.107898] ? nbd_xmit_timeout+0x500/0x500 [ 2527.112216] ? validate_nla+0x192/0x5e0 [ 2527.116187] ? nla_parse+0x157/0x1f0 [ 2527.119897] genl_family_rcv_msg+0x572/0xb20 [ 2527.124303] ? genl_rcv+0x40/0x40 [ 2527.127752] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2527.133202] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2527.138301] ? trace_hardirqs_on+0x10/0x10 [ 2527.142541] genl_rcv_msg+0xaf/0x140 [ 2527.146255] netlink_rcv_skb+0x125/0x390 [ 2527.150308] ? genl_family_rcv_msg+0xb20/0xb20 [ 2527.154893] ? netlink_ack+0x9a0/0x9a0 [ 2527.158803] ? lock_acquire+0x170/0x3f0 [ 2527.162780] genl_rcv+0x24/0x40 [ 2527.166060] netlink_unicast+0x437/0x610 [ 2527.170119] ? netlink_sendskb+0xd0/0xd0 [ 2527.174176] ? __check_object_size+0x179/0x230 [ 2527.178756] netlink_sendmsg+0x648/0xbc0 [ 2527.182848] ? nlmsg_notify+0x1b0/0x1b0 [ 2527.186820] ? kernel_recvmsg+0x210/0x210 [ 2527.190963] ? security_socket_sendmsg+0x83/0xb0 [ 2527.195722] ? nlmsg_notify+0x1b0/0x1b0 [ 2527.199691] sock_sendmsg+0xb5/0x100 [ 2527.203405] ___sys_sendmsg+0x6c8/0x800 [ 2527.207369] ? get_pid_task+0x91/0x130 [ 2527.211250] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2527.216005] ? lock_downgrade+0x740/0x740 [ 2527.220149] ? __fget+0x23e/0x3e0 [ 2527.223783] ? lock_acquire+0x170/0x3f0 [ 2527.227772] ? lock_downgrade+0x740/0x740 [ 2527.231923] ? __fget+0x265/0x3e0 [ 2527.235378] ? __fdget+0x19b/0x1f0 [ 2527.238915] ? sockfd_lookup_light+0xb2/0x160 [ 2527.243412] __sys_sendmsg+0xa3/0x120 [ 2527.247209] ? SyS_shutdown+0x160/0x160 12:32:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000180)) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x4) 12:32:28 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0xef, 0x9, 0x3, @loopback, @mcast2, 0x700, 0x7, 0x1}}) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x442082, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000080)=0x2, 0x4) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000180)) 12:32:28 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0xef, 0x9, 0x3, @loopback, @mcast2, 0x700, 0x7, 0x1}}) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x442082, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000080)=0x2, 0x4) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000180)) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000140)={'ip6tnl0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x2f, 0x1, 0xef, 0x9, 0x3, @loopback, @mcast2, 0x700, 0x7, 0x1}}) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040), 0x442082, 0x0) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000080)=0x2, 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x810c5701, &(0x7f0000000180)) (async) 12:32:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000180)) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x4) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000180)) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x4) (async) [ 2527.251180] ? wait_for_completion_io+0x10/0x10 [ 2527.255851] ? SyS_read+0x210/0x210 [ 2527.259471] ? __do_page_fault+0x159/0xad0 [ 2527.263700] SyS_sendmsg+0x27/0x40 [ 2527.267234] ? __sys_sendmsg+0x120/0x120 [ 2527.271286] do_syscall_64+0x1d5/0x640 [ 2527.275176] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2527.280357] RIP: 0033:0x7fc05f6a20e9 [ 2527.284061] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2527.291767] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 12:32:28 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(0xffffffffffffffff, 0x810c5701, &(0x7f0000000180)) (async) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x4) 12:32:28 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x4b8d, 0x101002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000340)={0x0}) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000100)={&(0x7f00000000c0)=[r2, r2, r2, r2, r4], 0x5}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000500)={0x40000002}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000440)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl0\x00', 0x0, 0x2f, 0xb0, 0x4, 0x4, 0x0, @mcast1, @local, 0x1, 0x20, 0xac2, 0x995}}) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r7, 0x20, &(0x7f00000002c0)={&(0x7f0000000140)=""/231, 0xe7, 0x0, &(0x7f0000000240)=""/83, 0x53}}, 0x10) [ 2527.299029] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2527.306298] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2527.313567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2527.320831] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2527.336810] blk-mq: reduced tag depth (128 -> 64) 12:32:29 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 15) 12:32:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}]}, 0x20}, 0x1, 0x0, 0x0, 0xc1}, 0x1) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='eRspan0\x00\x00\x00\x00\b\x00\x00\x00\x00', @ANYBLOB="42969557cdf587694969bbef720d9bd663674a2ef32a850fd83e30a7c5d82487c2c932c084fec3ad9fb9f96cb45d93168598181984bcaa284749dcceb0705cf43a2b9688f0d770cbbc35837a3a12233ca5f0880e2c68fef943fd241544999941fe", @ANYRES64=r2, @ANYRES64=r0, @ANYRESDEC=r1, @ANYRES64=r1]}) 12:32:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r1) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_DISASSOCIATE_REQ(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_REASON={0x5, 0x12, 0x4}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_REASON={0x5, 0x12, 0xcc}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4000) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_DISASSOCIATE_REQ(r5, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4085}, 0x8000) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="6332a79098f18d1f23010026f330e426ecd2b85d4e", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 12:32:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:29 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="99f52869062258bdb529202c000000", @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf250700000008000300", @ANYRES32=0x0, @ANYBLOB="05003000000000000800390009000000"], 0x2c}}, 0x800) (async, rerun: 32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:29 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) getsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000480), &(0x7f00000004c0)=0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x4b8d, 0x101002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000340)={0x0}) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000100)={&(0x7f00000000c0)=[r2, r2, r2, r2, r4], 0x5}) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000500)={0x40000002}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000440)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl0\x00', 0x0, 0x2f, 0xb0, 0x4, 0x4, 0x0, @mcast1, @local, 0x1, 0x20, 0xac2, 0x995}}) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r7, 0x20, &(0x7f00000002c0)={&(0x7f0000000140)=""/231, 0xe7, 0x0, &(0x7f0000000240)=""/83, 0x53}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000480), &(0x7f00000004c0)=0x4) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) syz_open_dev$dri(&(0x7f0000000040), 0x4b8d, 0x101002) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000340)) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000100)={&(0x7f00000000c0)=[r2, r2, r2, r2, r4], 0x5}) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000500)={0x40000002}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000440)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl0\x00', 0x0, 0x2f, 0xb0, 0x4, 0x4, 0x0, @mcast1, @local, 0x1, 0x20, 0xac2, 0x995}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r7, 0x20, &(0x7f00000002c0)={&(0x7f0000000140)=""/231, 0xe7, 0x0, &(0x7f0000000240)=""/83, 0x53}}, 0x10) (async) 12:32:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async, rerun: 64) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}]}, 0x20}, 0x1, 0x0, 0x0, 0xc1}, 0x1) (rerun: 64) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='eRspan0\x00\x00\x00\x00\b\x00\x00\x00\x00', @ANYBLOB="42969557cdf587694969bbef720d9bd663674a2ef32a850fd83e30a7c5d82487c2c932c084fec3ad9fb9f96cb45d93168598181984bcaa284749dcceb0705cf43a2b9688f0d770cbbc35837a3a12233ca5f0880e2c68fef943fd241544999941fe", @ANYRES64=r2, @ANYRES64=r0, @ANYRESDEC=r1, @ANYRES64=r1]}) 12:32:29 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r0, 0x11, 0xb, &(0x7f0000000480), &(0x7f00000004c0)=0x4) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x4b8d, 0x101002) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000340)={0x0}) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_SIGNAL(r3, 0xc01064c5, &(0x7f0000000100)={&(0x7f00000000c0)=[r2, r2, r2, r2, r4], 0x5}) (async, rerun: 32) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async, rerun: 32) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000500)={0x40000002}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r5, 0x89f8, &(0x7f0000000440)={'ip6_vti0\x00', &(0x7f00000003c0)={'syztnl0\x00', 0x0, 0x2f, 0xb0, 0x4, 0x4, 0x0, @mcast1, @local, 0x1, 0x20, 0xac2, 0x995}}) (async, rerun: 64) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 64) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000300)={r7, 0x20, &(0x7f00000002c0)={&(0x7f0000000140)=""/231, 0xe7, 0x0, &(0x7f0000000240)=""/83, 0x53}}, 0x10) [ 2527.481747] FAULT_INJECTION: forcing a failure. [ 2527.481747] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2527.514541] CPU: 1 PID: 2336 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2527.522358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2527.531709] Call Trace: [ 2527.534305] dump_stack+0x1b2/0x281 [ 2527.537942] should_fail.cold+0x10a/0x149 [ 2527.542088] __alloc_pages_nodemask+0x22c/0x2720 [ 2527.546837] ? kasan_kmalloc+0xeb/0x160 [ 2527.550805] ? blk_mq_alloc_rq_map+0x113/0x220 [ 2527.555385] ? __blk_mq_alloc_rq_map+0xa3/0x3a0 [ 2527.560046] ? nbd_dev_add+0x2ae/0x800 [ 2527.563923] ? nbd_genl_connect+0x3a4/0x1400 [ 2527.568326] ? genl_family_rcv_msg+0x572/0xb20 [ 2527.572904] ? genl_rcv+0x24/0x40 [ 2527.576352] ? netlink_unicast+0x437/0x610 [ 2527.580582] ? sock_sendmsg+0xb5/0x100 [ 2527.584464] ? ___sys_sendmsg+0x6c8/0x800 [ 2527.588607] ? __sys_sendmsg+0xa3/0x120 [ 2527.592571] ? SyS_sendmsg+0x27/0x40 [ 2527.596277] ? do_syscall_64+0x1d5/0x640 [ 2527.600333] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2527.605691] ? fs_reclaim_release+0xd0/0x110 [ 2527.610097] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2527.614943] ? __lockdep_init_map+0x100/0x560 [ 2527.619431] ? _find_next_bit+0xdb/0x100 [ 2527.623485] ? __cpu_to_node+0x7b/0xa0 [ 2527.627370] ? blk_mq_hw_queue_to_node+0x9f/0xf0 [ 2527.632125] blk_mq_alloc_rqs+0x227/0x6d0 [ 2527.636273] ? blk_mq_alloc_rq_map+0x9d/0x220 [ 2527.640766] __blk_mq_alloc_rq_map+0x15b/0x3a0 [ 2527.645348] blk_mq_alloc_tag_set+0x4ac/0x910 [ 2527.649842] nbd_dev_add+0x2ae/0x800 [ 2527.653549] ? nbd_send_cmd+0x11f0/0x11f0 [ 2527.657694] ? ns_capable_common+0x127/0x150 [ 2527.662099] nbd_genl_connect+0x3a4/0x1400 [ 2527.666324] ? lock_acquire+0x170/0x3f0 [ 2527.670318] ? nbd_xmit_timeout+0x500/0x500 [ 2527.674632] ? validate_nla+0x192/0x5e0 [ 2527.678601] ? nla_parse+0x157/0x1f0 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f0000000040)={0x10201, 0x0, &(0x7f0000ffb000/0x4000)=nil}) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="fdfe0500", @ANYRES16=0x0, @ANYBLOB="00042abd7000fcdbdf25060000000500130008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8005) [ 2527.682312] genl_family_rcv_msg+0x572/0xb20 [ 2527.686719] ? genl_rcv+0x40/0x40 [ 2527.691387] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2527.696835] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2527.701937] ? trace_hardirqs_on+0x10/0x10 [ 2527.706173] genl_rcv_msg+0xaf/0x140 [ 2527.709885] netlink_rcv_skb+0x125/0x390 [ 2527.713940] ? genl_family_rcv_msg+0xb20/0xb20 [ 2527.718515] ? netlink_ack+0x9a0/0x9a0 [ 2527.722400] ? lock_acquire+0x170/0x3f0 [ 2527.726374] genl_rcv+0x24/0x40 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f0000000040)={0x10201, 0x0, &(0x7f0000ffb000/0x4000)=nil}) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="fdfe0500", @ANYRES16=0x0, @ANYBLOB="00042abd7000fcdbdf25060000000500130008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8005) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f0000000040)={0x10201, 0x0, &(0x7f0000ffb000/0x4000)=nil}) (async) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="fdfe0500", @ANYRES16=0x0, @ANYBLOB="00042abd7000fcdbdf25060000000500130008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8005) (async) [ 2527.729670] netlink_unicast+0x437/0x610 [ 2527.733744] ? netlink_sendskb+0xd0/0xd0 [ 2527.737804] ? __check_object_size+0x179/0x230 [ 2527.742381] netlink_sendmsg+0x648/0xbc0 [ 2527.746439] ? nlmsg_notify+0x1b0/0x1b0 [ 2527.750404] ? kernel_recvmsg+0x210/0x210 [ 2527.754550] ? security_socket_sendmsg+0x83/0xb0 [ 2527.759303] ? nlmsg_notify+0x1b0/0x1b0 [ 2527.763271] sock_sendmsg+0xb5/0x100 [ 2527.766982] ___sys_sendmsg+0x6c8/0x800 [ 2527.770948] ? get_pid_task+0x91/0x130 [ 2527.774826] ? copy_msghdr_from_user+0x3b0/0x3b0 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f0000000040)={0x10201, 0x0, &(0x7f0000ffb000/0x4000)=nil}) (async) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="fdfe0500", @ANYRES16=0x0, @ANYBLOB="00042abd7000fcdbdf25060000000500130008000000"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x8005) [ 2527.779581] ? lock_downgrade+0x740/0x740 [ 2527.783732] ? __fget+0x23e/0x3e0 [ 2527.787192] ? lock_acquire+0x170/0x3f0 [ 2527.791164] ? lock_downgrade+0x740/0x740 [ 2527.795310] ? __fget+0x265/0x3e0 [ 2527.798766] ? __fdget+0x19b/0x1f0 [ 2527.802308] ? sockfd_lookup_light+0xb2/0x160 [ 2527.806803] __sys_sendmsg+0xa3/0x120 [ 2527.810596] ? SyS_shutdown+0x160/0x160 [ 2527.814565] ? wait_for_completion_io+0x10/0x10 [ 2527.819236] ? SyS_read+0x210/0x210 [ 2527.822859] ? __do_page_fault+0x159/0xad0 [ 2527.827088] SyS_sendmsg+0x27/0x40 [ 2527.830619] ? __sys_sendmsg+0x120/0x120 [ 2527.834676] do_syscall_64+0x1d5/0x640 [ 2527.838563] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2527.843741] RIP: 0033:0x7fc05f6a20e9 [ 2527.847439] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2527.855138] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2527.862398] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2527.869658] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r2, 0xcf3a921d82faf941, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xcf}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000010) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x2006}) [ 2527.876922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2527.884186] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:29 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 16) 12:32:29 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, 0x0, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_EXTENDED={0xc, 0x2d, {0xaaaaaaaaaaaa0102}}]}, 0x20}, 0x1, 0x0, 0x0, 0xc1}, 0x1) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000000)={'gre0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB='eRspan0\x00\x00\x00\x00\b\x00\x00\x00\x00', @ANYBLOB="42969557cdf587694969bbef720d9bd663674a2ef32a850fd83e30a7c5d82487c2c932c084fec3ad9fb9f96cb45d93168598181984bcaa284749dcceb0705cf43a2b9688f0d770cbbc35837a3a12233ca5f0880e2c68fef943fd241544999941fe", @ANYRES64=r2, @ANYRES64=r0, @ANYRESDEC=r1, @ANYRES64=r1]}) 12:32:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000140), r1) (async) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00', 0x0}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_DISASSOCIATE_REQ(r4, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x50, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@IEEE802154_ATTR_REASON={0x5, 0x12, 0x4}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_COORD_HW_ADDR={0xc}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa1}, @IEEE802154_ATTR_REASON={0x5, 0x12, 0xcc}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4000) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IEEE802154_DISASSOCIATE_REQ(r5, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x2, 0x70bd2c, 0x25dfdbfc, {}, [@IEEE802154_ATTR_COORD_HW_ADDR={0xc, 0x9, {0xaaaaaaaaaaaa0102}}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa3}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4085}, 0x8000) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="6332a79098f18d1f23010026f330e426ecd2b85d4e", @ANYRES16=r2, @ANYBLOB="010034000000009b62e607a0000008000300", @ANYRES32=r3], 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 12:32:29 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="99f52869062258bdb529202c000000", @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf250700000008000300", @ANYRES32=0x0, @ANYBLOB="05003000000000000800390009000000"], 0x2c}}, 0x800) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="99f52869062258bdb529202c000000", @ANYRES16=0x0, @ANYBLOB="000128bd7000fddbdf250700000008000300", @ANYRES32=0x0, @ANYBLOB="05003000000000000800390009000000"], 0x2c}}, 0x800) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r2, 0xcf3a921d82faf941, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xcf}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000010) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x2006}) 12:32:29 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:29 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_MRU={0xfffffffffffffe66}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xce78}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x81) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x29, 0x1, 0x2, 0x5, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x1, 0x7820, 0xffffffff, 0x25e}}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x40200, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="4000004500001440000000000490786401010464010102000000000000000000"]}) [ 2528.034811] FAULT_INJECTION: forcing a failure. [ 2528.034811] name failslab, interval 1, probability 0, space 0, times 0 [ 2528.079730] CPU: 1 PID: 2418 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2528.087541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2528.096892] Call Trace: [ 2528.099477] dump_stack+0x1b2/0x281 [ 2528.103108] should_fail.cold+0x10a/0x149 [ 2528.107257] should_failslab+0xd6/0x130 [ 2528.111231] kmem_cache_alloc_node+0x263/0x410 [ 2528.115816] blk_alloc_queue_node+0x2d/0xb40 [ 2528.120221] blk_mq_init_queue+0x42/0x90 [ 2528.124280] nbd_dev_add+0x2c6/0x800 [ 2528.127990] ? nbd_send_cmd+0x11f0/0x11f0 [ 2528.132132] ? ns_capable_common+0x127/0x150 [ 2528.136544] nbd_genl_connect+0x3a4/0x1400 [ 2528.140771] ? lock_acquire+0x170/0x3f0 [ 2528.144745] ? nbd_xmit_timeout+0x500/0x500 [ 2528.149063] ? validate_nla+0x192/0x5e0 [ 2528.153035] ? nla_parse+0x157/0x1f0 [ 2528.156748] genl_family_rcv_msg+0x572/0xb20 [ 2528.161161] ? genl_rcv+0x40/0x40 [ 2528.164608] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2528.170074] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2528.175176] ? trace_hardirqs_on+0x10/0x10 [ 2528.179413] genl_rcv_msg+0xaf/0x140 [ 2528.183122] netlink_rcv_skb+0x125/0x390 [ 2528.187183] ? genl_family_rcv_msg+0xb20/0xb20 [ 2528.191763] ? netlink_ack+0x9a0/0x9a0 [ 2528.195646] ? lock_acquire+0x170/0x3f0 [ 2528.199706] genl_rcv+0x24/0x40 [ 2528.202982] netlink_unicast+0x437/0x610 [ 2528.207039] ? netlink_sendskb+0xd0/0xd0 [ 2528.211098] ? __check_object_size+0x179/0x230 [ 2528.215676] netlink_sendmsg+0x648/0xbc0 [ 2528.219762] ? nlmsg_notify+0x1b0/0x1b0 [ 2528.223736] ? kernel_recvmsg+0x210/0x210 [ 2528.227875] ? security_socket_sendmsg+0x83/0xb0 [ 2528.232620] ? nlmsg_notify+0x1b0/0x1b0 [ 2528.236587] sock_sendmsg+0xb5/0x100 [ 2528.240296] ___sys_sendmsg+0x6c8/0x800 [ 2528.244264] ? get_pid_task+0x91/0x130 [ 2528.248167] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2528.252915] ? lock_downgrade+0x740/0x740 [ 2528.257051] ? __fget+0x23e/0x3e0 [ 2528.260486] ? lock_acquire+0x170/0x3f0 [ 2528.264435] ? lock_downgrade+0x740/0x740 [ 2528.268559] ? __fget+0x265/0x3e0 [ 2528.271991] ? __fdget+0x19b/0x1f0 [ 2528.275513] ? sockfd_lookup_light+0xb2/0x160 [ 2528.280006] __sys_sendmsg+0xa3/0x120 [ 2528.283848] ? SyS_shutdown+0x160/0x160 [ 2528.287799] ? wait_for_completion_io+0x10/0x10 [ 2528.292447] ? SyS_read+0x210/0x210 [ 2528.296057] ? __do_page_fault+0x159/0xad0 [ 2528.300283] SyS_sendmsg+0x27/0x40 [ 2528.303813] ? __sys_sendmsg+0x120/0x120 [ 2528.307882] do_syscall_64+0x1d5/0x640 [ 2528.311749] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2528.316939] RIP: 0033:0x7fc05f6a20e9 [ 2528.320631] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:29 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 17) 12:32:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0x1c}}, 0x20042005) [ 2528.328313] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2528.335565] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2528.342818] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2528.350066] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2528.357428] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2528.366982] nbd: failed to add new device 12:32:29 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_MRU={0xfffffffffffffe66}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xce78}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x81) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x29, 0x1, 0x2, 0x5, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x1, 0x7820, 0xffffffff, 0x25e}}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x40200, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="4000004500001440000000000490786401010464010102000000000000000000"]}) 12:32:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0x1c}}, 0x20042005) 12:32:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r2, 0xcf3a921d82faf941, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xcf}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000010) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x2006}) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x54, r2, 0xcf3a921d82faf941, 0x70bd27, 0x25dfdbfc, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x2}, @L2TP_ATTR_UDP_CSUM={0x5, 0xd, 0x1}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0xcf}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x7}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'hsr0\x00'}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @remote}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000800}, 0x20000010) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x2006}) (async) 12:32:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:30 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000002400000008000200496c"], 0x1c}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:30 executing program 4: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_MRU={0xfffffffffffffe66}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xce78}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x81) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x29, 0x1, 0x2, 0x5, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x1, 0x7820, 0xffffffff, 0x25e}}) r4 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x40200, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="4000004500001440000000000490786401010464010102000000000000000000"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x30, r2, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x3}, @L2TP_ATTR_MRU={0xfffffffffffffe66}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0xce78}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x81) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000180)={'ip6_vti0\x00', 0x0, 0x29, 0x1, 0x2, 0x5, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x1, 0x7820, 0xffffffff, 0x25e}}) (async) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000280), 0x40200, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r3, @ANYBLOB="4000004500001440000000000490786401010464010102000000000000000000"]}) (async) 12:32:30 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000240)={'wpan4\x00'}) (async) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[], 0x1c}}, 0x20042005) [ 2528.482830] FAULT_INJECTION: forcing a failure. [ 2528.482830] name failslab, interval 1, probability 0, space 0, times 0 [ 2528.505220] CPU: 1 PID: 2468 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2528.513029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2528.522388] Call Trace: [ 2528.524986] dump_stack+0x1b2/0x281 [ 2528.528615] should_fail.cold+0x10a/0x149 [ 2528.532764] should_failslab+0xd6/0x130 [ 2528.536748] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2528.541417] bioset_create+0x53/0x750 [ 2528.545214] ? kmem_cache_alloc_node+0x38b/0x410 [ 2528.549969] blk_alloc_queue_node+0xa8/0xb40 [ 2528.554376] blk_mq_init_queue+0x42/0x90 [ 2528.558432] nbd_dev_add+0x2c6/0x800 [ 2528.562177] ? nbd_send_cmd+0x11f0/0x11f0 [ 2528.566321] ? ns_capable_common+0x127/0x150 [ 2528.570733] nbd_genl_connect+0x3a4/0x1400 [ 2528.574962] ? lock_acquire+0x170/0x3f0 [ 2528.578931] ? nbd_xmit_timeout+0x500/0x500 [ 2528.583264] ? validate_nla+0x192/0x5e0 [ 2528.587235] ? nla_parse+0x157/0x1f0 [ 2528.590954] genl_family_rcv_msg+0x572/0xb20 [ 2528.595365] ? genl_rcv+0x40/0x40 [ 2528.598818] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2528.604274] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2528.609375] ? trace_hardirqs_on+0x10/0x10 [ 2528.613616] genl_rcv_msg+0xaf/0x140 [ 2528.617330] netlink_rcv_skb+0x125/0x390 [ 2528.621385] ? genl_family_rcv_msg+0xb20/0xb20 [ 2528.625962] ? netlink_ack+0x9a0/0x9a0 [ 2528.629846] ? lock_acquire+0x170/0x3f0 [ 2528.633825] genl_rcv+0x24/0x40 [ 2528.637098] netlink_unicast+0x437/0x610 [ 2528.641158] ? netlink_sendskb+0xd0/0xd0 [ 2528.645214] ? __check_object_size+0x179/0x230 [ 2528.649791] netlink_sendmsg+0x648/0xbc0 [ 2528.653846] ? nlmsg_notify+0x1b0/0x1b0 [ 2528.657810] ? kernel_recvmsg+0x210/0x210 [ 2528.661949] ? security_socket_sendmsg+0x83/0xb0 [ 2528.666682] ? nlmsg_notify+0x1b0/0x1b0 [ 2528.670643] sock_sendmsg+0xb5/0x100 [ 2528.674339] ___sys_sendmsg+0x6c8/0x800 [ 2528.678302] ? get_pid_task+0x91/0x130 [ 2528.682173] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2528.686918] ? lock_downgrade+0x740/0x740 [ 2528.691052] ? __fget+0x23e/0x3e0 [ 2528.694481] ? lock_acquire+0x170/0x3f0 [ 2528.698449] ? lock_downgrade+0x740/0x740 [ 2528.702582] ? __fget+0x265/0x3e0 [ 2528.706024] ? __fdget+0x19b/0x1f0 [ 2528.709550] ? sockfd_lookup_light+0xb2/0x160 [ 2528.714031] __sys_sendmsg+0xa3/0x120 [ 2528.717822] ? SyS_shutdown+0x160/0x160 [ 2528.721784] ? wait_for_completion_io+0x10/0x10 [ 2528.726435] ? SyS_read+0x210/0x210 [ 2528.730046] ? __do_page_fault+0x159/0xad0 [ 2528.734260] SyS_sendmsg+0x27/0x40 [ 2528.737780] ? __sys_sendmsg+0x120/0x120 [ 2528.741827] do_syscall_64+0x1d5/0x640 [ 2528.745707] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2528.750880] RIP: 0033:0x7fc05f6a20e9 [ 2528.754566] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2528.762251] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2528.769498] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2528.776751] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x6, 0x118, 0xfa00, {{0xfff, 0x35, "79c34ddd633bdd1afb30a16e03231d5c76c6e796d1f64e0fef09f0ee95abcec5d51b338c0b425ed7d43982a6aa3eb65032836bbcb17d80fb29d34c80bdd45c6ded0445587f1b883716605718e5f421413d335bcb17165384aeb1f125651ae564bca64692fce2160c8df4a5b9c1e1befcbfca780d20a8a424ecc5c32c9e9a4014cc2c764824cfca268d274e332fac7f75efde6a717f55c2613b2c0fc0a94a2a8d764d36d3f4b32b2d8cc56c861671b067f8b36ee945a877f5e5e566ed858f696f362be828da7955ca64579f0cff1dc37d5c3f9eba99b9ab9ab3bdf055738fc1198b7e416a42e62f7011d578c4eb5c26dbf92716faf4cb9877d8c0a86ac9abc5b7", 0xd1, 0x0, 0x2, 0x6, 0x0, 0x7, 0x3}, r1}}, 0x120) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000), 0x4) 12:32:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2528.784001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2528.791246] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2528.814051] nbd: failed to add new device 12:32:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x1, {{0x14, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x6, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xb, 0x21, [@private=0xa010102, @remote]}, @timestamp={0x44, 0x10, 0x9, 0x0, 0x6, [0x7, 0x3, 0x8000]}, @end, @rr={0x7, 0x1f, 0xb9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local, @local, @local, @local, @empty, @dev={0xac, 0x14, 0x14, 0x18}]}]}}}}}) 12:32:30 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 18) 12:32:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x1, {{0x14, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x6, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xb, 0x21, [@private=0xa010102, @remote]}, @timestamp={0x44, 0x10, 0x9, 0x0, 0x6, [0x7, 0x3, 0x8000]}, @end, @rr={0x7, 0x1f, 0xb9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local, @local, @local, @local, @empty, @dev={0xac, 0x14, 0x14, 0x18}]}]}}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x1, {{0x14, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x6, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xb, 0x21, [@private=0xa010102, @remote]}, @timestamp={0x44, 0x10, 0x9, 0x0, 0x6, [0x7, 0x3, 0x8000]}, @end, @rr={0x7, 0x1f, 0xb9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local, @local, @local, @local, @empty, @dev={0xac, 0x14, 0x14, 0x18}]}]}}}}}) (async) [ 2528.835341] nla_parse: 1 callbacks suppressed [ 2528.835347] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x6, 0x118, 0xfa00, {{0xfff, 0x35, "79c34ddd633bdd1afb30a16e03231d5c76c6e796d1f64e0fef09f0ee95abcec5d51b338c0b425ed7d43982a6aa3eb65032836bbcb17d80fb29d34c80bdd45c6ded0445587f1b883716605718e5f421413d335bcb17165384aeb1f125651ae564bca64692fce2160c8df4a5b9c1e1befcbfca780d20a8a424ecc5c32c9e9a4014cc2c764824cfca268d274e332fac7f75efde6a717f55c2613b2c0fc0a94a2a8d764d36d3f4b32b2d8cc56c861671b067f8b36ee945a877f5e5e566ed858f696f362be828da7955ca64579f0cff1dc37d5c3f9eba99b9ab9ab3bdf055738fc1198b7e416a42e62f7011d578c4eb5c26dbf92716faf4cb9877d8c0a86ac9abc5b7", 0xd1, 0x0, 0x2, 0x6, 0x0, 0x7, 0x3}, r1}}, 0x120) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000), 0x4) 12:32:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x6, 0x118, 0xfa00, {{0xfff, 0x35, "79c34ddd633bdd1afb30a16e03231d5c76c6e796d1f64e0fef09f0ee95abcec5d51b338c0b425ed7d43982a6aa3eb65032836bbcb17d80fb29d34c80bdd45c6ded0445587f1b883716605718e5f421413d335bcb17165384aeb1f125651ae564bca64692fce2160c8df4a5b9c1e1befcbfca780d20a8a424ecc5c32c9e9a4014cc2c764824cfca268d274e332fac7f75efde6a717f55c2613b2c0fc0a94a2a8d764d36d3f4b32b2d8cc56c861671b067f8b36ee945a877f5e5e566ed858f696f362be828da7955ca64579f0cff1dc37d5c3f9eba99b9ab9ab3bdf055738fc1198b7e416a42e62f7011d578c4eb5c26dbf92716faf4cb9877d8c0a86ac9abc5b7", 0xd1, 0x0, 0x2, 0x6, 0x0, 0x7, 0x3}, r1}}, 0x120) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000000), 0x4) [ 2528.903808] FAULT_INJECTION: forcing a failure. [ 2528.903808] name failslab, interval 1, probability 0, space 0, times 0 [ 2528.932809] CPU: 1 PID: 2514 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2528.940624] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2528.949979] Call Trace: [ 2528.952567] dump_stack+0x1b2/0x281 [ 2528.956199] should_fail.cold+0x10a/0x149 [ 2528.960345] should_failslab+0xd6/0x130 [ 2528.964321] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2528.968988] bioset_create+0x53/0x750 [ 2528.972787] ? kmem_cache_alloc_node+0x38b/0x410 [ 2528.977543] blk_alloc_queue_node+0xa8/0xb40 [ 2528.981950] blk_mq_init_queue+0x42/0x90 [ 2528.986008] nbd_dev_add+0x2c6/0x800 [ 2528.989713] ? nbd_send_cmd+0x11f0/0x11f0 [ 2528.993852] ? ns_capable_common+0x127/0x150 [ 2528.998259] nbd_genl_connect+0x3a4/0x1400 [ 2529.002495] ? lock_acquire+0x170/0x3f0 [ 2529.006469] ? nbd_xmit_timeout+0x500/0x500 [ 2529.010788] ? validate_nla+0x192/0x5e0 [ 2529.014763] ? nla_parse+0x157/0x1f0 [ 2529.018474] genl_family_rcv_msg+0x572/0xb20 [ 2529.022881] ? genl_rcv+0x40/0x40 [ 2529.026329] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2529.031773] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2529.036867] ? trace_hardirqs_on+0x10/0x10 [ 2529.041093] genl_rcv_msg+0xaf/0x140 [ 2529.044784] netlink_rcv_skb+0x125/0x390 [ 2529.048825] ? genl_family_rcv_msg+0xb20/0xb20 [ 2529.053390] ? netlink_ack+0x9a0/0x9a0 [ 2529.057263] ? lock_acquire+0x170/0x3f0 [ 2529.061229] genl_rcv+0x24/0x40 [ 2529.064488] netlink_unicast+0x437/0x610 [ 2529.068537] ? netlink_sendskb+0xd0/0xd0 [ 2529.072578] ? __check_object_size+0x179/0x230 [ 2529.077142] netlink_sendmsg+0x648/0xbc0 [ 2529.081195] ? nlmsg_notify+0x1b0/0x1b0 [ 2529.085151] ? kernel_recvmsg+0x210/0x210 [ 2529.089278] ? security_socket_sendmsg+0x83/0xb0 [ 2529.094025] ? nlmsg_notify+0x1b0/0x1b0 [ 2529.097996] sock_sendmsg+0xb5/0x100 [ 2529.101698] ___sys_sendmsg+0x6c8/0x800 [ 2529.105655] ? get_pid_task+0x91/0x130 [ 2529.109530] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2529.114281] ? lock_downgrade+0x740/0x740 [ 2529.118420] ? __fget+0x23e/0x3e0 [ 2529.121861] ? lock_acquire+0x170/0x3f0 [ 2529.125812] ? lock_downgrade+0x740/0x740 [ 2529.129941] ? __fget+0x265/0x3e0 [ 2529.133374] ? __fdget+0x19b/0x1f0 [ 2529.136899] ? sockfd_lookup_light+0xb2/0x160 [ 2529.141379] __sys_sendmsg+0xa3/0x120 [ 2529.145161] ? SyS_shutdown+0x160/0x160 [ 2529.149113] ? wait_for_completion_io+0x10/0x10 [ 2529.153763] ? SyS_read+0x210/0x210 [ 2529.157378] ? __do_page_fault+0x159/0xad0 [ 2529.161601] SyS_sendmsg+0x27/0x40 [ 2529.165120] ? __sys_sendmsg+0x120/0x120 [ 2529.169159] do_syscall_64+0x1d5/0x640 [ 2529.173024] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2529.178194] RIP: 0033:0x7fc05f6a20e9 [ 2529.181889] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2529.189571] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2529.196821] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 12:32:30 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (rerun: 32) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r1, 0x11, 0xa, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)={'erspan0\x00', 0x0, 0x20, 0x1, 0x0, 0x1, {{0x14, 0x4, 0x0, 0x0, 0x50, 0x0, 0x0, 0x6, 0x2f, 0x0, @multicast1, @local, {[@lsrr={0x83, 0xb, 0x21, [@private=0xa010102, @remote]}, @timestamp={0x44, 0x10, 0x9, 0x0, 0x6, [0x7, 0x3, 0x8000]}, @end, @rr={0x7, 0x1f, 0xb9, [@initdev={0xac, 0x1e, 0x1, 0x0}, @local, @local, @local, @local, @empty, @dev={0xac, 0x14, 0x14, 0x18}]}]}}}}}) 12:32:30 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000002400000008000200496c"], 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) 12:32:30 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r2, 0x9, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1251}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}]}, 0x34}}, 0x800) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000180)=0x2, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000000040)) 12:32:30 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x40, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2529.204074] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2529.211319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2529.218568] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2529.242970] nbd: failed to add new device 12:32:30 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 19) 12:32:30 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy2\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x404c000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x30}}, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000000)={0x2, 0xffffffc8}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={'ip6gre0\x00', r4, 0x29, 0x99, 0x5, 0x101, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x1, 0x7800, 0x4be, 0x9}}) sendmsg$BATADV_CMD_GET_VLAN(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x2}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r7, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r8) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r9, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r7, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, r9, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}]}, 0x20}, 0x1, 0x0, 0x0, 0x88}, 0xc002) 12:32:30 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2529.295721] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:30 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000180), r2) sendmsg$IEEE802154_LLSEC_GETPARAMS(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010000000000000000002400000008000200496c"], 0x1c}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) [ 2529.350855] FAULT_INJECTION: forcing a failure. [ 2529.350855] name failslab, interval 1, probability 0, space 0, times 0 [ 2529.374028] CPU: 1 PID: 2553 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2529.381839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2529.391193] Call Trace: [ 2529.393783] dump_stack+0x1b2/0x281 [ 2529.397417] should_fail.cold+0x10a/0x149 [ 2529.401583] should_failslab+0xd6/0x130 [ 2529.405558] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2529.410656] ? mempool_free+0x1d0/0x1d0 [ 2529.414630] __kmalloc_node+0x38/0x70 [ 2529.418428] mempool_create_node+0xb1/0x3e0 [ 2529.422745] ? mempool_kmalloc+0x20/0x20 [ 2529.426809] bioset_create+0x31b/0x750 [ 2529.430695] ? kmem_cache_alloc_node+0x38b/0x410 [ 2529.435450] blk_alloc_queue_node+0xa8/0xb40 [ 2529.439864] blk_mq_init_queue+0x42/0x90 [ 2529.443929] nbd_dev_add+0x2c6/0x800 [ 2529.447636] ? nbd_send_cmd+0x11f0/0x11f0 [ 2529.451893] ? ns_capable_common+0x127/0x150 [ 2529.456308] nbd_genl_connect+0x3a4/0x1400 [ 2529.460540] ? lock_acquire+0x170/0x3f0 [ 2529.464512] ? nbd_xmit_timeout+0x500/0x500 [ 2529.468848] ? validate_nla+0x192/0x5e0 [ 2529.472829] ? nla_parse+0x157/0x1f0 [ 2529.476547] genl_family_rcv_msg+0x572/0xb20 [ 2529.480958] ? genl_rcv+0x40/0x40 [ 2529.484408] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2529.489850] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2529.494962] ? trace_hardirqs_on+0x10/0x10 [ 2529.499207] genl_rcv_msg+0xaf/0x140 [ 2529.502916] netlink_rcv_skb+0x125/0x390 [ 2529.506976] ? genl_family_rcv_msg+0xb20/0xb20 [ 2529.511549] ? netlink_ack+0x9a0/0x9a0 [ 2529.515419] ? lock_acquire+0x170/0x3f0 [ 2529.519386] genl_rcv+0x24/0x40 [ 2529.522645] netlink_unicast+0x437/0x610 [ 2529.526686] ? netlink_sendskb+0xd0/0xd0 [ 2529.530723] ? __check_object_size+0x179/0x230 [ 2529.535283] netlink_sendmsg+0x648/0xbc0 [ 2529.539323] ? nlmsg_notify+0x1b0/0x1b0 [ 2529.543274] ? kernel_recvmsg+0x210/0x210 [ 2529.547400] ? security_socket_sendmsg+0x83/0xb0 [ 2529.552129] ? nlmsg_notify+0x1b0/0x1b0 [ 2529.556084] sock_sendmsg+0xb5/0x100 [ 2529.559790] ___sys_sendmsg+0x6c8/0x800 [ 2529.563750] ? get_pid_task+0x91/0x130 [ 2529.567618] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2529.572350] ? lock_downgrade+0x740/0x740 [ 2529.576485] ? __fget+0x23e/0x3e0 [ 2529.579922] ? lock_acquire+0x170/0x3f0 [ 2529.583872] ? lock_downgrade+0x740/0x740 [ 2529.587998] ? __fget+0x265/0x3e0 [ 2529.591428] ? __fdget+0x19b/0x1f0 [ 2529.594944] ? sockfd_lookup_light+0xb2/0x160 [ 2529.599420] __sys_sendmsg+0xa3/0x120 [ 2529.603206] ? SyS_shutdown+0x160/0x160 [ 2529.607162] ? wait_for_completion_io+0x10/0x10 [ 2529.611811] ? SyS_read+0x210/0x210 [ 2529.615416] ? __do_page_fault+0x159/0xad0 [ 2529.619639] SyS_sendmsg+0x27/0x40 [ 2529.623156] ? __sys_sendmsg+0x120/0x120 [ 2529.627197] do_syscall_64+0x1d5/0x640 [ 2529.631065] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2529.636246] RIP: 0033:0x7fc05f6a20e9 [ 2529.639947] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2529.647643] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2529.654977] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2529.662330] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2529.669587] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2529.676845] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:31 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:31 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 20) [ 2529.700158] nbd: failed to add new device 12:32:31 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) 12:32:31 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy2\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x404c000) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x30}}, 0x0) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000000)={0x2, 0xffffffc8}) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={'ip6gre0\x00', r4, 0x29, 0x99, 0x5, 0x101, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x1, 0x7800, 0x4be, 0x9}}) sendmsg$BATADV_CMD_GET_VLAN(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x2}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r7, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r8) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r9, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r7, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, r9, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}]}, 0x20}, 0x1, 0x0, 0x0, 0x88}, 0xc002) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy2\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x404c000) (async) syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x30}}, 0x0) (async) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000000)={0x2, 0xffffffc8}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={'ip6gre0\x00', r4, 0x29, 0x99, 0x5, 0x101, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x1, 0x7800, 0x4be, 0x9}}) (async) sendmsg$BATADV_CMD_GET_VLAN(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x2}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r7, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r8) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r9, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r7, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, r9, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}]}, 0x20}, 0x1, 0x0, 0x0, 0x88}, 0xc002) (async) 12:32:31 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r2, 0x9, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1251}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}]}, 0x34}}, 0x800) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000180)=0x2, 0x4) (async) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000000040)) 12:32:31 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000800)={&(0x7f0000000000), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4004800) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="d8f1f8ff4a7ee00d568b5466f25993aa25bbfaa24ed7d22abf2eb59ade1a390aad9cedaf0d79c33ab368650d50841efcbb946c45ca60c80898881d51b393ecc95cad1919d3bfbd335a44d1c4bf0d7964ee6deb73c16d6e7169bf6e3f06904e4180169eae7e7c1c9e2833199fb32b5e284ebd499c8096a7f2f2dcdb1f5056529c005b32d324d3ddee637aec47e10e7a3bf41eaa6b18ca599c6d602f39f59b30f91a8ac80f12442fda0000000000000000000000000000000075edced56f7a0344a83507d8335e81916fad3c11e27ef046e2e9abaf89162f8283130dc895f6140ab19eb3866098a4f7fe748c5b1d3cfb9ac9d2190f913fb2acc7f80883fdc81f0938098d35d5e1c0e682889d1329730c64d419597bf215b7830de79faeac1db302cb9f9c3d45dd0d182cf70f132869d1744224865fbeb73dd9eb73c483e721ed03a8cff5106c9ea96222cac9d0752c4f480135a1520e841e7d1c71e14ee583c5ac9831cf706f9796905dac764f36133afe5f94f3a2dedafd360000000100000001b7ff0e", @ANYRES16=0x0, @ANYBLOB="02002dbd7000ffdbdf252b0000000a0001007770616e34000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x662e72516bce4e42) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000e7b4b36ba9d0939711a9c50da0893b45d9549db19646b51f1"], 0x20}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000900)={'ip6_vti0\x00', &(0x7f0000000880)={'sit0\x00', r4, 0xee37ed90a9223a86, 0x8, 0x4, 0xc429, 0x40, @mcast1, @loopback, 0x711, 0x20, 0x1, 0x3}}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x70, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x2, 0x0}}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x13}}]}, 0x70}}, 0x840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r6, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(r6, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1011000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r8, 0x300, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20440100}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000ffdbdf25130000000c0009000200aaaaaaaaaaaa050003000400000005000300020000000c0009000201aaaaaaaaaaaa06000800feff00000c000900000200000000000006000800a0aa000084c19890e64076b910232c9b0cc90f440751f89c4f"], 0x58}, 0x1, 0x0, 0x0, 0x2000c010}, 0x80) 12:32:31 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2529.796640] FAULT_INJECTION: forcing a failure. [ 2529.796640] name failslab, interval 1, probability 0, space 0, times 0 [ 2529.821374] CPU: 1 PID: 2584 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2529.829188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2529.838541] Call Trace: [ 2529.841138] dump_stack+0x1b2/0x281 [ 2529.844765] should_fail.cold+0x10a/0x149 [ 2529.848913] should_failslab+0xd6/0x130 [ 2529.852897] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2529.857996] ? mempool_free+0x1d0/0x1d0 [ 2529.861978] __kmalloc_node+0x38/0x70 [ 2529.865788] mempool_create_node+0xb1/0x3e0 [ 2529.870106] ? mempool_kmalloc+0x20/0x20 [ 2529.874168] bioset_create+0x31b/0x750 [ 2529.878062] ? kmem_cache_alloc_node+0x38b/0x410 [ 2529.882815] blk_alloc_queue_node+0xa8/0xb40 [ 2529.887222] blk_mq_init_queue+0x42/0x90 [ 2529.891279] nbd_dev_add+0x2c6/0x800 [ 2529.894991] ? nbd_send_cmd+0x11f0/0x11f0 [ 2529.899135] ? ns_capable_common+0x127/0x150 [ 2529.903544] nbd_genl_connect+0x3a4/0x1400 [ 2529.907778] ? lock_acquire+0x170/0x3f0 [ 2529.911751] ? nbd_xmit_timeout+0x500/0x500 [ 2529.916070] ? validate_nla+0x192/0x5e0 [ 2529.920041] ? nla_parse+0x157/0x1f0 [ 2529.923750] genl_family_rcv_msg+0x572/0xb20 [ 2529.928157] ? genl_rcv+0x40/0x40 [ 2529.931609] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2529.937145] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2529.942241] ? trace_hardirqs_on+0x10/0x10 12:32:31 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2529.946486] genl_rcv_msg+0xaf/0x140 [ 2529.950191] netlink_rcv_skb+0x125/0x390 [ 2529.954249] ? genl_family_rcv_msg+0xb20/0xb20 [ 2529.958826] ? netlink_ack+0x9a0/0x9a0 [ 2529.962708] ? lock_acquire+0x170/0x3f0 [ 2529.966681] genl_rcv+0x24/0x40 [ 2529.969952] netlink_unicast+0x437/0x610 [ 2529.974010] ? netlink_sendskb+0xd0/0xd0 [ 2529.978063] ? __check_object_size+0x179/0x230 [ 2529.982644] netlink_sendmsg+0x648/0xbc0 [ 2529.986701] ? nlmsg_notify+0x1b0/0x1b0 [ 2529.990669] ? kernel_recvmsg+0x210/0x210 [ 2529.994812] ? security_socket_sendmsg+0x83/0xb0 [ 2529.999566] ? nlmsg_notify+0x1b0/0x1b0 [ 2530.003535] sock_sendmsg+0xb5/0x100 [ 2530.007249] ___sys_sendmsg+0x6c8/0x800 [ 2530.011215] ? get_pid_task+0x91/0x130 [ 2530.015097] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2530.019851] ? lock_downgrade+0x740/0x740 [ 2530.023997] ? __fget+0x23e/0x3e0 [ 2530.027451] ? lock_acquire+0x170/0x3f0 [ 2530.031418] ? lock_downgrade+0x740/0x740 [ 2530.035565] ? __fget+0x265/0x3e0 [ 2530.039021] ? __fdget+0x19b/0x1f0 [ 2530.042563] ? sockfd_lookup_light+0xb2/0x160 12:32:31 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2530.047055] __sys_sendmsg+0xa3/0x120 [ 2530.050852] ? SyS_shutdown+0x160/0x160 [ 2530.054821] ? wait_for_completion_io+0x10/0x10 [ 2530.059493] ? SyS_read+0x210/0x210 [ 2530.063112] ? __do_page_fault+0x159/0xad0 [ 2530.067342] SyS_sendmsg+0x27/0x40 [ 2530.070883] ? __sys_sendmsg+0x120/0x120 [ 2530.074949] do_syscall_64+0x1d5/0x640 [ 2530.078834] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2530.084016] RIP: 0033:0x7fc05f6a20e9 [ 2530.087720] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:31 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) [ 2530.095425] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2530.102683] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2530.109946] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2530.117210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2530.124468] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:31 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000020009078e0000001ac1414aa"]}) 12:32:31 executing program 0: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r2, 0x9, 0x70bd2b, 0x25dfdbff, {}, [@L2TP_ATTR_MRU={0x6, 0x1d, 0x1251}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x80}]}, 0x34}}, 0x800) (async, rerun: 64) r3 = socket$inet6_udp(0xa, 0x2, 0x0) (rerun: 64) setsockopt$inet6_udp_int(r3, 0x11, 0x1, &(0x7f0000000180)=0x2, 0x4) setsockopt$inet6_udp_int(r3, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000000040)) [ 2530.157440] nbd: failed to add new device 12:32:31 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 21) 12:32:31 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:31 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000400)={0x44, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy2\x00'}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy0\x00'}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x404c000) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_CCA_MODE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x30, r2, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x30}}, 0x0) (async) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000000)={0x2, 0xffffffc8}) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000280)={'sit0\x00', &(0x7f0000000200)={'ip6gre0\x00', r4, 0x29, 0x99, 0x5, 0x101, 0x8, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @rand_addr=' \x01\x00', 0x1, 0x7800, 0x4be, 0x9}}) sendmsg$BATADV_CMD_GET_VLAN(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, 0x0, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x6}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x2}, @BATADV_ATTR_GW_MODE={0x5}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x34}, 0x1, 0x0, 0x0, 0x8080}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r7, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r8) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r9, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEV(r7, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, r9, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}]}, 0x20}, 0x1, 0x0, 0x0, 0x88}, 0xc002) 12:32:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000800)={&(0x7f0000000000), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4004800) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="d8f1f8ff4a7ee00d568b5466f25993aa25bbfaa24ed7d22abf2eb59ade1a390aad9cedaf0d79c33ab368650d50841efcbb946c45ca60c80898881d51b393ecc95cad1919d3bfbd335a44d1c4bf0d7964ee6deb73c16d6e7169bf6e3f06904e4180169eae7e7c1c9e2833199fb32b5e284ebd499c8096a7f2f2dcdb1f5056529c005b32d324d3ddee637aec47e10e7a3bf41eaa6b18ca599c6d602f39f59b30f91a8ac80f12442fda0000000000000000000000000000000075edced56f7a0344a83507d8335e81916fad3c11e27ef046e2e9abaf89162f8283130dc895f6140ab19eb3866098a4f7fe748c5b1d3cfb9ac9d2190f913fb2acc7f80883fdc81f0938098d35d5e1c0e682889d1329730c64d419597bf215b7830de79faeac1db302cb9f9c3d45dd0d182cf70f132869d1744224865fbeb73dd9eb73c483e721ed03a8cff5106c9ea96222cac9d0752c4f480135a1520e841e7d1c71e14ee583c5ac9831cf706f9796905dac764f36133afe5f94f3a2dedafd360000000100000001b7ff0e", @ANYRES16=0x0, @ANYBLOB="02002dbd7000ffdbdf252b0000000a0001007770616e34000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x662e72516bce4e42) (async, rerun: 32) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000e7b4b36ba9d0939711a9c50da0893b45d9549db19646b51f1"], 0x20}}, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000900)={'ip6_vti0\x00', &(0x7f0000000880)={'sit0\x00', r4, 0xee37ed90a9223a86, 0x8, 0x4, 0xc429, 0x40, @mcast1, @loopback, 0x711, 0x20, 0x1, 0x3}}) (async) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x70, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x2, 0x0}}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x13}}]}, 0x70}}, 0x840) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r6, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r8, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_LIST_KEY(r6, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1011000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r8, 0x300, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20440100}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000ffdbdf25130000000c0009000200aaaaaaaaaaaa050003000400000005000300020000000c0009000201aaaaaaaaaaaa06000800feff00000c000900000200000000000006000800a0aa000084c19890e64076b910232c9b0cc90f440751f89c4f"], 0x58}, 0x1, 0x0, 0x0, 0x2000c010}, 0x80) 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:31 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2530.256635] FAULT_INJECTION: forcing a failure. [ 2530.256635] name failslab, interval 1, probability 0, space 0, times 0 [ 2530.299266] CPU: 0 PID: 2651 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2530.307087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2530.316606] Call Trace: [ 2530.319193] dump_stack+0x1b2/0x281 [ 2530.322827] should_fail.cold+0x10a/0x149 [ 2530.326978] should_failslab+0xd6/0x130 [ 2530.330952] kmem_cache_alloc+0x28e/0x3c0 [ 2530.335098] ? mempool_free+0x1d0/0x1d0 [ 2530.339077] mempool_create_node+0x2d2/0x3e0 [ 2530.343485] bioset_create+0x31b/0x750 [ 2530.347371] ? kmem_cache_alloc_node+0x38b/0x410 [ 2530.352127] blk_alloc_queue_node+0xa8/0xb40 [ 2530.356536] blk_mq_init_queue+0x42/0x90 [ 2530.360595] nbd_dev_add+0x2c6/0x800 [ 2530.364302] ? nbd_send_cmd+0x11f0/0x11f0 [ 2530.368445] ? ns_capable_common+0x127/0x150 [ 2530.372850] nbd_genl_connect+0x3a4/0x1400 [ 2530.377084] ? lock_acquire+0x170/0x3f0 [ 2530.381055] ? nbd_xmit_timeout+0x500/0x500 [ 2530.385380] ? validate_nla+0x192/0x5e0 [ 2530.389350] ? nla_parse+0x157/0x1f0 [ 2530.393078] genl_family_rcv_msg+0x572/0xb20 [ 2530.397488] ? genl_rcv+0x40/0x40 [ 2530.400939] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2530.406385] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2530.411486] ? trace_hardirqs_on+0x10/0x10 [ 2530.415725] genl_rcv_msg+0xaf/0x140 [ 2530.419523] netlink_rcv_skb+0x125/0x390 [ 2530.423585] ? genl_family_rcv_msg+0xb20/0xb20 [ 2530.428165] ? netlink_ack+0x9a0/0x9a0 [ 2530.432050] ? lock_acquire+0x170/0x3f0 [ 2530.436031] genl_rcv+0x24/0x40 [ 2530.439308] netlink_unicast+0x437/0x610 [ 2530.443368] ? netlink_sendskb+0xd0/0xd0 [ 2530.447427] ? __check_object_size+0x179/0x230 [ 2530.452011] netlink_sendmsg+0x648/0xbc0 [ 2530.456079] ? nlmsg_notify+0x1b0/0x1b0 [ 2530.460051] ? kernel_recvmsg+0x210/0x210 [ 2530.464204] ? security_socket_sendmsg+0x83/0xb0 [ 2530.468967] ? nlmsg_notify+0x1b0/0x1b0 [ 2530.473056] sock_sendmsg+0xb5/0x100 [ 2530.476769] ___sys_sendmsg+0x6c8/0x800 [ 2530.480744] ? get_pid_task+0x91/0x130 [ 2530.484632] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2530.489388] ? lock_downgrade+0x740/0x740 [ 2530.493536] ? __fget+0x23e/0x3e0 12:32:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x200400c0}, 0x24004840) 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:31 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) [ 2530.496989] ? lock_acquire+0x170/0x3f0 [ 2530.500960] ? lock_downgrade+0x740/0x740 [ 2530.505110] ? __fget+0x265/0x3e0 [ 2530.508567] ? __fdget+0x19b/0x1f0 [ 2530.512106] ? sockfd_lookup_light+0xb2/0x160 [ 2530.516605] __sys_sendmsg+0xa3/0x120 [ 2530.520400] ? SyS_shutdown+0x160/0x160 [ 2530.524377] ? wait_for_completion_io+0x10/0x10 [ 2530.529048] ? SyS_read+0x210/0x210 [ 2530.532671] ? __do_page_fault+0x159/0xad0 [ 2530.536908] SyS_sendmsg+0x27/0x40 [ 2530.540449] ? __sys_sendmsg+0x120/0x120 [ 2530.544504] do_syscall_64+0x1d5/0x640 [ 2530.548478] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2530.553836] RIP: 0033:0x7fc05f6a20e9 [ 2530.557548] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2530.565234] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2530.572487] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2530.579736] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2530.587072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 12:32:32 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 22) 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f", @ANYRES32=0x0]}) 12:32:32 executing program 4: write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f0000000180)={0x8, 0x120, 0xfa00, {0x2, {0x5, 0x8, "6c78b103a2942959215500e0cceeaf1ee32aa6f12e3a66743d7f729f1a95182852abc8a4af832e106c129989fc4790831612ffc971485264ef837fc4711a1e4336326c80a7c9dd731a7f6a67396c14c3d76ad0a6bf958ba754da97ef8b49fb0bd1d4e3b99c407dacc8337329187beb7d60c567fcf500278762fdadd7326a4023d13fc32092f33950e1cb93c7bfee34b2b38794bf9d1d1abd9183f73f8590541bfad1711999d3d9133ff44bb4f8f3082a1e654a24cb79360d089a64f853fe2c1d6484d869ea691552984d894a0eaed307dd75b96db3de4f7dbb0bf0cd7ab4eb8b75ce88fa991f92c7055de1071b7019fa2d344dfd29c99f607ae316c470fb22ef", 0x1f, 0x20, 0x9, 0xff, 0x0, 0x1c}}}, 0x128) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f00000002c0)={0x8, 0x120, 0xfa00, {0x3, {0x8, 0x3ff, "242259e0f8cece8c0d641bb6fcae82b6b8758382048a0261e424bb76edac845607b451b01a109a5524f295f82e084b88e44914a6ec41bbb0ed4859eec7790e71b4e2e6754be60a28bc3f01102ce58e1e9ae62d16ff8f89c84e438f70eca3e57b10638f0e29cb5bc6cf593b0687781835613dcc9f2b80a732284a02d589ee4a59fd58290f7534cdacdf0f61d43a2cb04115df7d1c3eee9d224fcfc280770aa3d34b0bec249994bbcf894bf45f2479228e6109bc9bb103d8ea767694693bacac2f31cc836e9326cdcfa075751d19ce18d0f2326afa06e0f69310310dd3e164317c3d476481214a653808f37c398740016a6f9e6529c7c6708c1cfa9c15d4c657f3", 0x20, 0x7, 0xf7, 0xcb, 0x5, 0x4, 0x8}}}, 0x128) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000455cf6f56c96d00000140000000000009078e000"]}) 12:32:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x200400c0}, 0x24004840) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x200400c0}, 0x24004840) (async) 12:32:32 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000800)={&(0x7f0000000000), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4004800) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="d8f1f8ff4a7ee00d568b5466f25993aa25bbfaa24ed7d22abf2eb59ade1a390aad9cedaf0d79c33ab368650d50841efcbb946c45ca60c80898881d51b393ecc95cad1919d3bfbd335a44d1c4bf0d7964ee6deb73c16d6e7169bf6e3f06904e4180169eae7e7c1c9e2833199fb32b5e284ebd499c8096a7f2f2dcdb1f5056529c005b32d324d3ddee637aec47e10e7a3bf41eaa6b18ca599c6d602f39f59b30f91a8ac80f12442fda0000000000000000000000000000000075edced56f7a0344a83507d8335e81916fad3c11e27ef046e2e9abaf89162f8283130dc895f6140ab19eb3866098a4f7fe748c5b1d3cfb9ac9d2190f913fb2acc7f80883fdc81f0938098d35d5e1c0e682889d1329730c64d419597bf215b7830de79faeac1db302cb9f9c3d45dd0d182cf70f132869d1744224865fbeb73dd9eb73c483e721ed03a8cff5106c9ea96222cac9d0752c4f480135a1520e841e7d1c71e14ee583c5ac9831cf706f9796905dac764f36133afe5f94f3a2dedafd360000000100000001b7ff0e", @ANYRES16=0x0, @ANYBLOB="02002dbd7000ffdbdf252b0000000a0001007770616e34000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x662e72516bce4e42) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000e7b4b36ba9d0939711a9c50da0893b45d9549db19646b51f1"], 0x20}}, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000900)={'ip6_vti0\x00', &(0x7f0000000880)={'sit0\x00', r4, 0xee37ed90a9223a86, 0x8, 0x4, 0xc429, 0x40, @mcast1, @loopback, 0x711, 0x20, 0x1, 0x3}}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x70, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x2, 0x0}}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x13}}]}, 0x70}}, 0x840) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r6, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r7) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r8, 0x1}, 0x14}}, 0x0) sendmsg$IEEE802154_LLSEC_LIST_KEY(r6, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1011000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r8, 0x300, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20440100}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000ffdbdf25130000000c0009000200aaaaaaaaaaaa050003000400000005000300020000000c0009000201aaaaaaaaaaaa06000800feff00000c000900000200000000000006000800a0aa000084c19890e64076b910232c9b0cc90f440751f89c4f"], 0x58}, 0x1, 0x0, 0x0, 0x2000c010}, 0x80) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000800)={&(0x7f0000000000), 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x28, 0x0, 0x20, 0x70bd28, 0x25dfdbff, {}, [@IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4004800) (async) sendmsg$IEEE802154_LLSEC_DEL_DEV(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000540)=ANY=[@ANYBLOB="d8f1f8ff4a7ee00d568b5466f25993aa25bbfaa24ed7d22abf2eb59ade1a390aad9cedaf0d79c33ab368650d50841efcbb946c45ca60c80898881d51b393ecc95cad1919d3bfbd335a44d1c4bf0d7964ee6deb73c16d6e7169bf6e3f06904e4180169eae7e7c1c9e2833199fb32b5e284ebd499c8096a7f2f2dcdb1f5056529c005b32d324d3ddee637aec47e10e7a3bf41eaa6b18ca599c6d602f39f59b30f91a8ac80f12442fda0000000000000000000000000000000075edced56f7a0344a83507d8335e81916fad3c11e27ef046e2e9abaf89162f8283130dc895f6140ab19eb3866098a4f7fe748c5b1d3cfb9ac9d2190f913fb2acc7f80883fdc81f0938098d35d5e1c0e682889d1329730c64d419597bf215b7830de79faeac1db302cb9f9c3d45dd0d182cf70f132869d1744224865fbeb73dd9eb73c483e721ed03a8cff5106c9ea96222cac9d0752c4f480135a1520e841e7d1c71e14ee583c5ac9831cf706f9796905dac764f36133afe5f94f3a2dedafd360000000100000001b7ff0e", @ANYRES16=0x0, @ANYBLOB="02002dbd7000ffdbdf252b0000000a0001007770616e34000000"], 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x662e72516bce4e42) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000e7b4b36ba9d0939711a9c50da0893b45d9549db19646b51f1"], 0x20}}, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(0xffffffffffffffff, 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r4, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000900)={'ip6_vti0\x00', &(0x7f0000000880)={'sit0\x00', r4, 0xee37ed90a9223a86, 0x8, 0x4, 0xc429, 0x40, @mcast1, @loopback, 0x711, 0x20, 0x1, 0x3}}) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000003c0)={0x70, r2, 0x200, 0x70bd25, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5, 0x22, 0x1}, @L2TP_ATTR_FD={0x8, 0x17, @udp6=r5}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @local}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e24}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @empty}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x2, 0x0}}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_UDP_CSUM={0x5}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @dev={0xac, 0x14, 0x14, 0x13}}]}, 0x70}}, 0x840) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NLBL_CALIPSO_C_LISTALL(r6, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r7) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x14, r8, 0x1}, 0x14}}, 0x0) (async) sendmsg$IEEE802154_LLSEC_LIST_KEY(r6, &(0x7f0000000700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1011000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r8, 0x300, 0x70bd2b, 0x25dfdbfc, {}, ["", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x10}, 0x20004010) (async) sendmsg$IEEE802154_ASSOCIATE_RESP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20440100}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000ffdbdf25130000000c0009000200aaaaaaaaaaaa050003000400000005000300020000000c0009000201aaaaaaaaaaaa06000800feff00000c000900000200000000000006000800a0aa000084c19890e64076b910232c9b0cc90f440751f89c4f"], 0x58}, 0x1, 0x0, 0x0, 0x2000c010}, 0x80) (async) 12:32:32 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x24, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2530.594316] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2530.607149] nbd: failed to add new device 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6da1bd623b9873ef15e5cef4cdcfb772222170e3cb16452f"]}) [ 2530.678719] FAULT_INJECTION: forcing a failure. [ 2530.678719] name failslab, interval 1, probability 0, space 0, times 0 [ 2530.716236] CPU: 0 PID: 2702 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2530.724044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2530.733401] Call Trace: [ 2530.735986] dump_stack+0x1b2/0x281 [ 2530.739620] should_fail.cold+0x10a/0x149 [ 2530.743783] should_failslab+0xd6/0x130 [ 2530.747764] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2530.752864] ? mempool_free+0x1d0/0x1d0 [ 2530.756837] mempool_create_node+0x76/0x3e0 [ 2530.761157] ? mempool_kmalloc+0x20/0x20 [ 2530.765219] bioset_create+0x506/0x750 [ 2530.769116] ? kmem_cache_alloc_node+0x38b/0x410 [ 2530.773873] blk_alloc_queue_node+0xa8/0xb40 12:32:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x200400c0}, 0x24004840) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000180), 0x40000, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_SETPARAMS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x48, 0x0, 0x300, 0x70bd2a, 0x25dfdbfb, {}, [@IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x6}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x2}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x7}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0x1}, @IEEE802154_ATTR_PAN_ID={0x6}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x200400c0}, 0x24004840) (async) [ 2530.778286] blk_mq_init_queue+0x42/0x90 [ 2530.782344] nbd_dev_add+0x2c6/0x800 [ 2530.786053] ? nbd_send_cmd+0x11f0/0x11f0 [ 2530.790194] ? ns_capable_common+0x127/0x150 [ 2530.794601] nbd_genl_connect+0x3a4/0x1400 [ 2530.798839] ? nbd_xmit_timeout+0x500/0x500 [ 2530.803159] ? validate_nla+0x192/0x5e0 [ 2530.807309] ? nla_parse+0x157/0x1f0 [ 2530.811020] genl_family_rcv_msg+0x572/0xb20 [ 2530.815424] ? genl_rcv+0x40/0x40 [ 2530.818874] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2530.824327] ? trace_hardirqs_on+0x10/0x10 12:32:32 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000)=0x80000000, 0x4) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080), &(0x7f00000000c0)=[0x9, 0xffffffffffffffff, 0x100000000, 0x200], 0x0, 0x1}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=0x0, @ANYBLOB="04002cbd7000ffdbdf25010000000c00040009000000000000005400078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="9b8ae0e8b3", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="0c000800040000000000000008000100000000000c00060006000000000000000f000a002f6465762f6e7672616d0000"], 0xa4}}, 0x40001) [ 2530.828572] genl_rcv_msg+0xaf/0x140 [ 2530.832285] netlink_rcv_skb+0x125/0x390 [ 2530.836341] ? genl_family_rcv_msg+0xb20/0xb20 [ 2530.840918] ? netlink_ack+0x9a0/0x9a0 [ 2530.844802] ? lock_acquire+0x170/0x3f0 [ 2530.848778] genl_rcv+0x24/0x40 [ 2530.852048] netlink_unicast+0x437/0x610 [ 2530.856101] ? netlink_sendskb+0xd0/0xd0 [ 2530.860171] ? __check_object_size+0x179/0x230 [ 2530.864835] netlink_sendmsg+0x648/0xbc0 [ 2530.868891] ? nlmsg_notify+0x1b0/0x1b0 [ 2530.872863] ? kernel_recvmsg+0x210/0x210 [ 2530.877007] ? security_socket_sendmsg+0x83/0xb0 [ 2530.881755] ? nlmsg_notify+0x1b0/0x1b0 [ 2530.885725] sock_sendmsg+0xb5/0x100 [ 2530.889435] ___sys_sendmsg+0x6c8/0x800 [ 2530.893405] ? get_pid_task+0x91/0x130 [ 2530.897289] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2530.902047] ? lock_downgrade+0x740/0x740 [ 2530.906201] ? __fget+0x23e/0x3e0 [ 2530.909653] ? lock_acquire+0x170/0x3f0 [ 2530.913605] ? lock_downgrade+0x740/0x740 [ 2530.917731] ? __fget+0x265/0x3e0 [ 2530.921162] ? __fdget+0x19b/0x1f0 [ 2530.924679] ? sockfd_lookup_light+0xb2/0x160 [ 2530.929151] __sys_sendmsg+0xa3/0x120 [ 2530.932929] ? SyS_shutdown+0x160/0x160 [ 2530.936880] ? wait_for_completion_io+0x10/0x10 [ 2530.941529] ? SyS_read+0x210/0x210 [ 2530.945129] ? __do_page_fault+0x159/0xad0 [ 2530.949342] SyS_sendmsg+0x27/0x40 [ 2530.952857] ? __sys_sendmsg+0x120/0x120 [ 2530.956905] do_syscall_64+0x1d5/0x640 [ 2530.961059] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2530.961069] RIP: 0033:0x7fc05f6a20e9 [ 2530.969944] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) 12:32:32 executing program 4: write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f0000000180)={0x8, 0x120, 0xfa00, {0x2, {0x5, 0x8, "6c78b103a2942959215500e0cceeaf1ee32aa6f12e3a66743d7f729f1a95182852abc8a4af832e106c129989fc4790831612ffc971485264ef837fc4711a1e4336326c80a7c9dd731a7f6a67396c14c3d76ad0a6bf958ba754da97ef8b49fb0bd1d4e3b99c407dacc8337329187beb7d60c567fcf500278762fdadd7326a4023d13fc32092f33950e1cb93c7bfee34b2b38794bf9d1d1abd9183f73f8590541bfad1711999d3d9133ff44bb4f8f3082a1e654a24cb79360d089a64f853fe2c1d6484d869ea691552984d894a0eaed307dd75b96db3de4f7dbb0bf0cd7ab4eb8b75ce88fa991f92c7055de1071b7019fa2d344dfd29c99f607ae316c470fb22ef", 0x1f, 0x20, 0x9, 0xff, 0x0, 0x1c}}}, 0x128) (async) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f00000002c0)={0x8, 0x120, 0xfa00, {0x3, {0x8, 0x3ff, "242259e0f8cece8c0d641bb6fcae82b6b8758382048a0261e424bb76edac845607b451b01a109a5524f295f82e084b88e44914a6ec41bbb0ed4859eec7790e71b4e2e6754be60a28bc3f01102ce58e1e9ae62d16ff8f89c84e438f70eca3e57b10638f0e29cb5bc6cf593b0687781835613dcc9f2b80a732284a02d589ee4a59fd58290f7534cdacdf0f61d43a2cb04115df7d1c3eee9d224fcfc280770aa3d34b0bec249994bbcf894bf45f2479228e6109bc9bb103d8ea767694693bacac2f31cc836e9326cdcfa075751d19ce18d0f2326afa06e0f69310310dd3e164317c3d476481214a653808f37c398740016a6f9e6529c7c6708c1cfa9c15d4c657f3", 0x20, 0x7, 0xf7, 0xcb, 0x5, 0x4, 0x8}}}, 0x128) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000455cf6f56c96d00000140000000000009078e000"]}) 12:32:32 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 64) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) (rerun: 64) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async, rerun: 32) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000)=0x80000000, 0x4) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080), &(0x7f00000000c0)=[0x9, 0xffffffffffffffff, 0x100000000, 0x200], 0x0, 0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r1) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async, rerun: 64) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) (async, rerun: 64) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=0x0, @ANYBLOB="04002cbd7000ffdbdf25010000000c00040009000000000000005400078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="9b8ae0e8b3", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="0c000800040000000000000008000100000000000c00060006000000000000000f000a002f6465762f6e7672616d0000"], 0xa4}}, 0x40001) [ 2530.977639] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2530.984901] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2530.992160] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2530.999424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2531.006675] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2531.016481] nbd: failed to add new device 12:32:32 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 23) 12:32:32 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x24, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) 12:32:32 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0xa0000003}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:32 executing program 4: write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f0000000180)={0x8, 0x120, 0xfa00, {0x2, {0x5, 0x8, "6c78b103a2942959215500e0cceeaf1ee32aa6f12e3a66743d7f729f1a95182852abc8a4af832e106c129989fc4790831612ffc971485264ef837fc4711a1e4336326c80a7c9dd731a7f6a67396c14c3d76ad0a6bf958ba754da97ef8b49fb0bd1d4e3b99c407dacc8337329187beb7d60c567fcf500278762fdadd7326a4023d13fc32092f33950e1cb93c7bfee34b2b38794bf9d1d1abd9183f73f8590541bfad1711999d3d9133ff44bb4f8f3082a1e654a24cb79360d089a64f853fe2c1d6484d869ea691552984d894a0eaed307dd75b96db3de4f7dbb0bf0cd7ab4eb8b75ce88fa991f92c7055de1071b7019fa2d344dfd29c99f607ae316c470fb22ef", 0x1f, 0x20, 0x9, 0xff, 0x0, 0x1c}}}, 0x128) (async, rerun: 64) write$RDMA_USER_CM_CMD_ACCEPT(0xffffffffffffffff, &(0x7f00000002c0)={0x8, 0x120, 0xfa00, {0x3, {0x8, 0x3ff, "242259e0f8cece8c0d641bb6fcae82b6b8758382048a0261e424bb76edac845607b451b01a109a5524f295f82e084b88e44914a6ec41bbb0ed4859eec7790e71b4e2e6754be60a28bc3f01102ce58e1e9ae62d16ff8f89c84e438f70eca3e57b10638f0e29cb5bc6cf593b0687781835613dcc9f2b80a732284a02d589ee4a59fd58290f7534cdacdf0f61d43a2cb04115df7d1c3eee9d224fcfc280770aa3d34b0bec249994bbcf894bf45f2479228e6109bc9bb103d8ea767694693bacac2f31cc836e9326cdcfa075751d19ce18d0f2326afa06e0f69310310dd3e164317c3d476481214a653808f37c398740016a6f9e6529c7c6708c1cfa9c15d4c657f3", 0x20, 0x7, 0xf7, 0xcb, 0x5, 0x4, 0x8}}}, 0x128) (rerun: 64) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000455cf6f56c96d00000140000000000009078e000"]}) [ 2531.103783] FAULT_INJECTION: forcing a failure. [ 2531.103783] name failslab, interval 1, probability 0, space 0, times 0 [ 2531.141567] CPU: 0 PID: 2771 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2531.149471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2531.158833] Call Trace: [ 2531.161782] dump_stack+0x1b2/0x281 [ 2531.165411] should_fail.cold+0x10a/0x149 [ 2531.169559] should_failslab+0xd6/0x130 [ 2531.173534] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2531.178641] ? mempool_free+0x1d0/0x1d0 [ 2531.182616] mempool_create_node+0x76/0x3e0 [ 2531.186935] ? mempool_kmalloc+0x20/0x20 [ 2531.190996] bioset_create+0x506/0x750 [ 2531.194878] ? kmem_cache_alloc_node+0x38b/0x410 [ 2531.199635] blk_alloc_queue_node+0xa8/0xb40 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) 12:32:32 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="8c64b6f1f0b22b28a7d10b7e604d2a0bffb7112b4bf066a356e4094d4f27afa00f05aca79aec03c675accae9e9d18c3d489a64c4ac41425a19436553ceca43a8480de1ebd35a16cd2e34db5f7a29a2e8b724aadb7e34bbd37537c137d0e3550e02a90e67d6d53f6ed24c296cd7d72a4e905356a6826762e4f09838a4ff547e08b3b994d5fd577d38fdb1000026806824cf7f560df347d144dc86216b9e01671cb4cc29060c9884b7a84cdc93d3a224bc4ebc928e7ade74d5dc62d251a9fac75c07b2a557feef3b6fc357983d2cf07e7cedb0eab19aa975088360eda7868f6a477372c9c3465c0f16b8b25f53198ade93a9a4ab34a508986224ad15a0b34348c77c6abee07180a8993c9c6abf6ee118711b0ca6afdaaa5e8a8101e352b40d619b35e7c2dd1327acebbd9fff42bf", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078750f0001ac1414aa"]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000700), r0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xab7}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x88c5}, 0x400888c) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x11, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3ff}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @map_idx={0x18, 0x6, 0x5, 0x0, 0xf}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2a2, 0x0, 0x0, 0x0, 0x3}, @exit, @func, @call={0x85, 0x0, 0x0, 0x67}, @map_fd={0x18, 0x4, 0x1, 0x0, r5}]}, &(0x7f0000000500)='GPL\x00', 0x6, 0x98, &(0x7f0000000540)=""/152, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000640)={0x2, 0xc, 0x9, 0x2}, 0x10}, 0x80) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[0x0, r2, r3, 0x0, 0x0], &(0x7f0000000140)=[0xee7, 0x7, 0x6], 0x5, 0x5, 0x1}) [ 2531.204042] blk_mq_init_queue+0x42/0x90 [ 2531.208103] nbd_dev_add+0x2c6/0x800 [ 2531.211813] ? nbd_send_cmd+0x11f0/0x11f0 [ 2531.215956] ? ns_capable_common+0x127/0x150 [ 2531.220379] nbd_genl_connect+0x3a4/0x1400 [ 2531.220393] ? lock_acquire+0x170/0x3f0 [ 2531.228584] ? nbd_xmit_timeout+0x500/0x500 [ 2531.228596] ? validate_nla+0x192/0x5e0 [ 2531.228606] ? nla_parse+0x157/0x1f0 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2531.228621] genl_family_rcv_msg+0x572/0xb20 [ 2531.228635] ? genl_rcv+0x40/0x40 [ 2531.228648] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2531.228660] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2531.228671] ? trace_hardirqs_on+0x10/0x10 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2531.228690] genl_rcv_msg+0xaf/0x140 [ 2531.228700] netlink_rcv_skb+0x125/0x390 [ 2531.228710] ? genl_family_rcv_msg+0xb20/0xb20 [ 2531.228720] ? netlink_ack+0x9a0/0x9a0 [ 2531.228729] ? lock_acquire+0x170/0x3f0 [ 2531.228746] genl_rcv+0x24/0x40 [ 2531.228754] netlink_unicast+0x437/0x610 [ 2531.228766] ? netlink_sendskb+0xd0/0xd0 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2531.228775] ? __check_object_size+0x179/0x230 [ 2531.228786] netlink_sendmsg+0x648/0xbc0 [ 2531.228798] ? nlmsg_notify+0x1b0/0x1b0 [ 2531.228806] ? kernel_recvmsg+0x210/0x210 [ 2531.228820] ? security_socket_sendmsg+0x83/0xb0 [ 2531.228829] ? nlmsg_notify+0x1b0/0x1b0 [ 2531.228836] sock_sendmsg+0xb5/0x100 [ 2531.228847] ___sys_sendmsg+0x6c8/0x800 [ 2531.228856] ? get_pid_task+0x91/0x130 12:32:32 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b6d"]}) [ 2531.228867] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2531.228879] ? lock_downgrade+0x740/0x740 [ 2531.228892] ? __fget+0x23e/0x3e0 [ 2531.228903] ? lock_acquire+0x170/0x3f0 [ 2531.228912] ? lock_downgrade+0x740/0x740 [ 2531.228925] ? __fget+0x265/0x3e0 [ 2531.228939] ? __fdget+0x19b/0x1f0 [ 2531.228948] ? sockfd_lookup_light+0xb2/0x160 [ 2531.228960] __sys_sendmsg+0xa3/0x120 [ 2531.228969] ? SyS_shutdown+0x160/0x160 [ 2531.228978] ? wait_for_completion_io+0x10/0x10 [ 2531.228995] ? SyS_read+0x210/0x210 [ 2531.229005] ? __do_page_fault+0x159/0xad0 [ 2531.229015] SyS_sendmsg+0x27/0x40 [ 2531.229023] ? __sys_sendmsg+0x120/0x120 [ 2531.229032] do_syscall_64+0x1d5/0x640 [ 2531.229047] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2531.229055] RIP: 0033:0x7fc05f6a20e9 [ 2531.229060] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2531.229077] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2531.229082] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2531.229088] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:33 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000)=0x80000000, 0x4) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000040)={0x0, 0x1}) (async) ioctl$DRM_IOCTL_SYNCOBJ_QUERY(r0, 0xc01864cb, &(0x7f0000000100)={&(0x7f0000000080), &(0x7f00000000c0)=[0x9, 0xffffffffffffffff, 0x100000000, 0x200], 0x0, 0x1}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r0, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), r1) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="a4000000", @ANYRES16=0x0, @ANYBLOB="04002cbd7000ffdbdf25010000000c00040009000000000000005400078008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5, @ANYBLOB="9b8ae0e8b3", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="0c000800040000000000000008000100000000000c00060006000000000000000f000a002f6465762f6e7672616d0000"], 0xa4}}, 0x40001) [ 2531.229093] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2531.229099] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2531.398739] nbd: failed to add new device 12:32:33 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 24) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) 12:32:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="8c64b6f1f0b22b28a7d10b7e604d2a0bffb7112b4bf066a356e4094d4f27afa00f05aca79aec03c675accae9e9d18c3d489a64c4ac41425a19436553ceca43a8480de1ebd35a16cd2e34db5f7a29a2e8b724aadb7e34bbd37537c137d0e3550e02a90e67d6d53f6ed24c296cd7d72a4e905356a6826762e4f09838a4ff547e08b3b994d5fd577d38fdb1000026806824cf7f560df347d144dc86216b9e01671cb4cc29060c9884b7a84cdc93d3a224bc4ebc928e7ade74d5dc62d251a9fac75c07b2a557feef3b6fc357983d2cf07e7cedb0eab19aa975088360eda7868f6a477372c9c3465c0f16b8b25f53198ade93a9a4ab34a508986224ad15a0b34348c77c6abee07180a8993c9c6abf6ee118711b0ca6afdaaa5e8a8101e352b40d619b35e7c2dd1327acebbd9fff42bf", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078750f0001ac1414aa"]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000700), r0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) (async, rerun: 32) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) (rerun: 32) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_ORIGINATORS(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xab7}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x88c5}, 0x400888c) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x11, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3ff}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @map_idx={0x18, 0x6, 0x5, 0x0, 0xf}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2a2, 0x0, 0x0, 0x0, 0x3}, @exit, @func, @call={0x85, 0x0, 0x0, 0x67}, @map_fd={0x18, 0x4, 0x1, 0x0, r5}]}, &(0x7f0000000500)='GPL\x00', 0x6, 0x98, &(0x7f0000000540)=""/152, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000640)={0x2, 0xc, 0x9, 0x2}, 0x10}, 0x80) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[0x0, r2, r3, 0x0, 0x0], &(0x7f0000000140)=[0xee7, 0x7, 0x6], 0x5, 0x5, 0x1}) 12:32:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x24, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:33 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0xa0000003}) (async, rerun: 32) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 32) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:33 executing program 0: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB="8c64b6f1f0b22b28a7d10b7e604d2a0bffb7112b4bf066a356e4094d4f27afa00f05aca79aec03c675accae9e9d18c3d489a64c4ac41425a19436553ceca43a8480de1ebd35a16cd2e34db5f7a29a2e8b724aadb7e34bbd37537c137d0e3550e02a90e67d6d53f6ed24c296cd7d72a4e905356a6826762e4f09838a4ff547e08b3b994d5fd577d38fdb1000026806824cf7f560df347d144dc86216b9e01671cb4cc29060c9884b7a84cdc93d3a224bc4ebc928e7ade74d5dc62d251a9fac75c07b2a557feef3b6fc357983d2cf07e7cedb0eab19aa975088360eda7868f6a477372c9c3465c0f16b8b25f53198ade93a9a4ab34a508986224ad15a0b34348c77c6abee07180a8993c9c6abf6ee118711b0ca6afdaaa5e8a8101e352b40d619b35e7c2dd1327acebbd9fff42bf", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078750f0001ac1414aa"]}) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000700), r0) (async) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000080)={0x0, 0x1}) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) sendmsg$BATADV_CMD_GET_ORIGINATORS(r4, &(0x7f0000000280)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, 0x0, 0x2, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x9}, @BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xab7}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x88c5}, 0x400888c) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x11, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3ff}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0x3}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @map_idx={0x18, 0x6, 0x5, 0x0, 0xf}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2a2, 0x0, 0x0, 0x0, 0x3}, @exit, @func, @call={0x85, 0x0, 0x0, 0x67}, @map_fd={0x18, 0x4, 0x1, 0x0, r5}]}, &(0x7f0000000500)='GPL\x00', 0x6, 0x98, &(0x7f0000000540)=""/152, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x9, 0x4}, 0x8, 0x10, &(0x7f0000000640)={0x2, 0xc, 0x9, 0x2}, 0x10}, 0x80) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(r1, 0xc02864ca, &(0x7f0000000180)={&(0x7f0000000100)=[0x0, r2, r3, 0x0, 0x0], &(0x7f0000000140)=[0xee7, 0x7, 0x6], 0x5, 0x5, 0x1}) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2531.651780] FAULT_INJECTION: forcing a failure. [ 2531.651780] name failslab, interval 1, probability 0, space 0, times 0 [ 2531.672987] CPU: 1 PID: 2838 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2531.680798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2531.690144] Call Trace: [ 2531.692734] dump_stack+0x1b2/0x281 [ 2531.696378] should_fail.cold+0x10a/0x149 [ 2531.700532] should_failslab+0xd6/0x130 [ 2531.704510] kmem_cache_alloc+0x28e/0x3c0 [ 2531.708657] ? mempool_free+0x1d0/0x1d0 [ 2531.712629] mempool_create_node+0x2d2/0x3e0 [ 2531.717039] bioset_create+0x506/0x750 [ 2531.720927] ? kmem_cache_alloc_node+0x38b/0x410 [ 2531.725685] blk_alloc_queue_node+0xa8/0xb40 [ 2531.730094] blk_mq_init_queue+0x42/0x90 [ 2531.734134] nbd_dev_add+0x2c6/0x800 [ 2531.737844] ? nbd_send_cmd+0x11f0/0x11f0 [ 2531.741985] ? ns_capable_common+0x127/0x150 [ 2531.746409] nbd_genl_connect+0x3a4/0x1400 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2531.750722] ? lock_acquire+0x170/0x3f0 [ 2531.755218] ? nbd_xmit_timeout+0x500/0x500 [ 2531.759538] ? validate_nla+0x192/0x5e0 [ 2531.763514] ? nla_parse+0x157/0x1f0 [ 2531.767229] genl_family_rcv_msg+0x572/0xb20 [ 2531.771643] ? genl_rcv+0x40/0x40 [ 2531.775101] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2531.780643] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2531.785746] ? trace_hardirqs_on+0x10/0x10 [ 2531.789982] genl_rcv_msg+0xaf/0x140 [ 2531.793690] netlink_rcv_skb+0x125/0x390 [ 2531.797749] ? genl_family_rcv_msg+0xb20/0xb20 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6"]}) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6"]}) [ 2531.802330] ? netlink_ack+0x9a0/0x9a0 [ 2531.806212] ? lock_acquire+0x170/0x3f0 [ 2531.810185] genl_rcv+0x24/0x40 [ 2531.813459] netlink_unicast+0x437/0x610 [ 2531.817513] ? netlink_sendskb+0xd0/0xd0 [ 2531.821570] ? __check_object_size+0x179/0x230 [ 2531.826148] netlink_sendmsg+0x648/0xbc0 [ 2531.830380] ? nlmsg_notify+0x1b0/0x1b0 [ 2531.834351] ? kernel_recvmsg+0x210/0x210 [ 2531.838495] ? security_socket_sendmsg+0x83/0xb0 [ 2531.843243] ? nlmsg_notify+0x1b0/0x1b0 [ 2531.847215] sock_sendmsg+0xb5/0x100 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6"]}) [ 2531.850926] ___sys_sendmsg+0x6c8/0x800 [ 2531.854893] ? get_pid_task+0x91/0x130 [ 2531.858774] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2531.863529] ? lock_downgrade+0x740/0x740 [ 2531.867674] ? __fget+0x23e/0x3e0 [ 2531.871124] ? lock_acquire+0x170/0x3f0 [ 2531.875093] ? lock_downgrade+0x740/0x740 [ 2531.879246] ? __fget+0x265/0x3e0 [ 2531.882708] ? __fdget+0x19b/0x1f0 [ 2531.886240] ? sockfd_lookup_light+0xb2/0x160 [ 2531.890726] __sys_sendmsg+0xa3/0x120 [ 2531.894516] ? SyS_shutdown+0x160/0x160 [ 2531.898486] ? wait_for_completion_io+0x10/0x10 [ 2531.903159] ? SyS_read+0x210/0x210 [ 2531.906788] ? __do_page_fault+0x159/0xad0 [ 2531.911020] SyS_sendmsg+0x27/0x40 [ 2531.914565] ? __sys_sendmsg+0x120/0x120 [ 2531.918622] do_syscall_64+0x1d5/0x640 [ 2531.922510] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2531.927691] RIP: 0033:0x7fc05f6a20e9 [ 2531.931392] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2531.939092] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2531.946354] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 12:32:33 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 25) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c"]}) 12:32:33 executing program 0: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) [ 2531.953618] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2531.960876] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2531.968126] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2531.976046] nbd: failed to add new device 12:32:33 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, 0xffffffffffffffff, &(0x7f0000000080)={0xa0000003}) (async, rerun: 64) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c"]}) 12:32:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) (async) 12:32:33 executing program 0: ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) (async) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:33 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x0) 12:32:33 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c"]}) 12:32:33 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2532.105660] FAULT_INJECTION: forcing a failure. [ 2532.105660] name failslab, interval 1, probability 0, space 0, times 0 [ 2532.154934] CPU: 0 PID: 2902 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2532.162749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2532.172100] Call Trace: [ 2532.174686] dump_stack+0x1b2/0x281 [ 2532.178316] should_fail.cold+0x10a/0x149 [ 2532.182467] should_failslab+0xd6/0x130 [ 2532.186445] kmem_cache_alloc+0x28e/0x3c0 [ 2532.190589] ? mempool_free+0x1d0/0x1d0 [ 2532.194571] mempool_create_node+0x2d2/0x3e0 [ 2532.198985] bioset_create+0x506/0x750 [ 2532.202873] ? kmem_cache_alloc_node+0x38b/0x410 [ 2532.207626] blk_alloc_queue_node+0xa8/0xb40 [ 2532.212032] blk_mq_init_queue+0x42/0x90 [ 2532.216089] nbd_dev_add+0x2c6/0x800 [ 2532.219796] ? nbd_send_cmd+0x11f0/0x11f0 [ 2532.223944] ? ns_capable_common+0x127/0x150 [ 2532.228351] nbd_genl_connect+0x3a4/0x1400 [ 2532.232581] ? lock_acquire+0x170/0x3f0 [ 2532.236555] ? nbd_xmit_timeout+0x500/0x500 [ 2532.240872] ? validate_nla+0x192/0x5e0 [ 2532.244842] ? nla_parse+0x157/0x1f0 [ 2532.248557] genl_family_rcv_msg+0x572/0xb20 [ 2532.252962] ? genl_rcv+0x40/0x40 [ 2532.256414] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2532.261862] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2532.266975] ? trace_hardirqs_on+0x10/0x10 [ 2532.271205] genl_rcv_msg+0xaf/0x140 [ 2532.274897] netlink_rcv_skb+0x125/0x390 [ 2532.278942] ? genl_family_rcv_msg+0xb20/0xb20 [ 2532.283502] ? netlink_ack+0x9a0/0x9a0 [ 2532.287369] ? lock_acquire+0x170/0x3f0 [ 2532.291361] genl_rcv+0x24/0x40 [ 2532.294624] netlink_unicast+0x437/0x610 [ 2532.298662] ? netlink_sendskb+0xd0/0xd0 [ 2532.302700] ? __check_object_size+0x179/0x230 [ 2532.307262] netlink_sendmsg+0x648/0xbc0 [ 2532.311312] ? nlmsg_notify+0x1b0/0x1b0 [ 2532.315278] ? kernel_recvmsg+0x210/0x210 [ 2532.319404] ? security_socket_sendmsg+0x83/0xb0 [ 2532.324142] ? nlmsg_notify+0x1b0/0x1b0 [ 2532.328093] sock_sendmsg+0xb5/0x100 [ 2532.331783] ___sys_sendmsg+0x6c8/0x800 [ 2532.335736] ? get_pid_task+0x91/0x130 [ 2532.339598] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2532.344344] ? lock_downgrade+0x740/0x740 [ 2532.348470] ? __fget+0x23e/0x3e0 [ 2532.351901] ? lock_acquire+0x170/0x3f0 [ 2532.355855] ? lock_downgrade+0x740/0x740 [ 2532.360027] ? __fget+0x265/0x3e0 [ 2532.363459] ? __fdget+0x19b/0x1f0 [ 2532.366974] ? sockfd_lookup_light+0xb2/0x160 [ 2532.371448] __sys_sendmsg+0xa3/0x120 [ 2532.375228] ? SyS_shutdown+0x160/0x160 [ 2532.379188] ? wait_for_completion_io+0x10/0x10 [ 2532.383839] ? SyS_read+0x210/0x210 [ 2532.387444] ? __do_page_fault+0x159/0xad0 [ 2532.391656] SyS_sendmsg+0x27/0x40 [ 2532.395173] ? __sys_sendmsg+0x120/0x120 [ 2532.399211] do_syscall_64+0x1d5/0x640 [ 2532.403089] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2532.408255] RIP: 0033:0x7fc05f6a20e9 [ 2532.411944] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2532.419631] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2532.426886] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2532.434131] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2532.441519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2532.448767] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:34 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 26) 12:32:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x4, 0x3, 0x4, 0x81, 0x4, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x80, 0x200, 0x5}}) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'sit0\x00', r3, 0x4, 0x8, 0x4, 0x44a, 0x0, @private1, @local, 0x1, 0x20, 0x7, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x4, 0x8, 0xff, 0x20, 0x48, @private0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x40, 0xc0, 0x1, 0x3}}) 12:32:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) syz_open_dev$amidi(&(0x7f0000000180), 0x2, 0x41) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) [ 2532.483758] nbd: failed to add new device [ 2532.546678] FAULT_INJECTION: forcing a failure. [ 2532.546678] name failslab, interval 1, probability 0, space 0, times 0 [ 2532.564470] CPU: 0 PID: 2936 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2532.572276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2532.581722] Call Trace: [ 2532.584326] dump_stack+0x1b2/0x281 [ 2532.587962] should_fail.cold+0x10a/0x149 [ 2532.592113] should_failslab+0xd6/0x130 [ 2532.596088] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2532.601199] bdi_alloc_node+0x5d/0x2e0 [ 2532.605101] blk_alloc_queue_node+0xe2/0xb40 [ 2532.609510] blk_mq_init_queue+0x42/0x90 [ 2532.613581] nbd_dev_add+0x2c6/0x800 [ 2532.617290] ? nbd_send_cmd+0x11f0/0x11f0 [ 2532.621435] ? ns_capable_common+0x127/0x150 [ 2532.625841] nbd_genl_connect+0x3a4/0x1400 [ 2532.630071] ? lock_acquire+0x170/0x3f0 [ 2532.634042] ? nbd_xmit_timeout+0x500/0x500 [ 2532.638365] ? validate_nla+0x192/0x5e0 [ 2532.642331] ? nla_parse+0x157/0x1f0 [ 2532.646025] genl_family_rcv_msg+0x572/0xb20 [ 2532.650411] ? genl_rcv+0x40/0x40 [ 2532.653841] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2532.659270] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2532.664349] ? trace_hardirqs_on+0x10/0x10 [ 2532.668564] genl_rcv_msg+0xaf/0x140 [ 2532.672257] netlink_rcv_skb+0x125/0x390 [ 2532.676302] ? genl_family_rcv_msg+0xb20/0xb20 [ 2532.680859] ? netlink_ack+0x9a0/0x9a0 [ 2532.684722] ? lock_acquire+0x170/0x3f0 [ 2532.688801] genl_rcv+0x24/0x40 [ 2532.692057] netlink_unicast+0x437/0x610 [ 2532.696093] ? netlink_sendskb+0xd0/0xd0 [ 2532.700130] ? __check_object_size+0x179/0x230 [ 2532.704688] netlink_sendmsg+0x648/0xbc0 [ 2532.708727] ? nlmsg_notify+0x1b0/0x1b0 [ 2532.712677] ? kernel_recvmsg+0x210/0x210 [ 2532.716806] ? security_socket_sendmsg+0x83/0xb0 [ 2532.721533] ? nlmsg_notify+0x1b0/0x1b0 [ 2532.725482] sock_sendmsg+0xb5/0x100 [ 2532.729171] ___sys_sendmsg+0x6c8/0x800 [ 2532.733125] ? get_pid_task+0x91/0x130 [ 2532.736992] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2532.741733] ? lock_downgrade+0x740/0x740 [ 2532.745866] ? __fget+0x23e/0x3e0 [ 2532.749297] ? lock_acquire+0x170/0x3f0 [ 2532.753245] ? lock_downgrade+0x740/0x740 [ 2532.757369] ? __fget+0x265/0x3e0 [ 2532.760800] ? __fdget+0x19b/0x1f0 [ 2532.764326] ? sockfd_lookup_light+0xb2/0x160 [ 2532.768796] __sys_sendmsg+0xa3/0x120 [ 2532.772579] ? SyS_shutdown+0x160/0x160 [ 2532.776532] ? wait_for_completion_io+0x10/0x10 [ 2532.781179] ? SyS_read+0x210/0x210 [ 2532.784781] ? __do_page_fault+0x159/0xad0 [ 2532.789002] SyS_sendmsg+0x27/0x40 [ 2532.792526] ? __sys_sendmsg+0x120/0x120 [ 2532.796565] do_syscall_64+0x1d5/0x640 [ 2532.800432] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2532.805599] RIP: 0033:0x7fc05f6a20e9 [ 2532.809283] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2532.816968] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2532.824213] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2532.831457] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2532.838700] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2532.845949] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:34 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 27) 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) 12:32:34 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x0) 12:32:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x4, 0x3, 0x4, 0x81, 0x4, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x80, 0x200, 0x5}}) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'sit0\x00', r3, 0x4, 0x8, 0x4, 0x44a, 0x0, @private1, @local, 0x1, 0x20, 0x7, 0x8}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x4, 0x8, 0xff, 0x20, 0x48, @private0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x40, 0xc0, 0x1, 0x3}}) 12:32:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) (async) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) syz_open_dev$amidi(&(0x7f0000000180), 0x2, 0x41) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2532.876912] nbd: failed to add new device 12:32:34 executing program 3: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000280)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x0, 0x6, 0x2, @dev={0xfe, 0x80, '\x00', 0x34}, @dev={0xfe, 0x80, '\x00', 0xdb}, 0x7800, 0x7800, 0x2, 0xdf}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x5ad000, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r1, 0x400, 0x70bd2c, 0x400, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x72aa01e60000}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c0}, 0x20008080) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400), 0x802, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r5, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x7}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x5e}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x48040}, 0x8015) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0xc080) 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) [ 2532.938523] FAULT_INJECTION: forcing a failure. [ 2532.938523] name failslab, interval 1, probability 0, space 0, times 0 [ 2532.976762] CPU: 1 PID: 2952 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e92b"]}) [ 2532.984588] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2532.993952] Call Trace: [ 2532.996541] dump_stack+0x1b2/0x281 [ 2533.000168] should_fail.cold+0x10a/0x149 [ 2533.004321] should_failslab+0xd6/0x130 [ 2533.008301] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2533.012971] wb_congested_get_create+0x15b/0x360 [ 2533.017734] wb_init+0x4f6/0x7c0 [ 2533.021097] ? __raw_spin_lock_init+0x28/0x100 [ 2533.025680] cgwb_bdi_init+0xe2/0x1e0 [ 2533.029479] bdi_alloc_node+0x224/0x2e0 [ 2533.033450] blk_alloc_queue_node+0xe2/0xb40 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) [ 2533.037857] blk_mq_init_queue+0x42/0x90 [ 2533.041912] nbd_dev_add+0x2c6/0x800 [ 2533.045621] ? nbd_send_cmd+0x11f0/0x11f0 [ 2533.049765] ? ns_capable_common+0x127/0x150 [ 2533.054174] nbd_genl_connect+0x3a4/0x1400 [ 2533.058404] ? lock_acquire+0x170/0x3f0 [ 2533.062374] ? nbd_xmit_timeout+0x500/0x500 [ 2533.066689] ? validate_nla+0x192/0x5e0 [ 2533.070662] ? nla_parse+0x157/0x1f0 [ 2533.074382] genl_family_rcv_msg+0x572/0xb20 [ 2533.078791] ? genl_rcv+0x40/0x40 [ 2533.082249] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) [ 2533.087696] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2533.093053] ? trace_hardirqs_on+0x10/0x10 [ 2533.097298] genl_rcv_msg+0xaf/0x140 [ 2533.101009] netlink_rcv_skb+0x125/0x390 [ 2533.105067] ? genl_family_rcv_msg+0xb20/0xb20 [ 2533.109647] ? netlink_ack+0x9a0/0x9a0 [ 2533.113525] ? lock_acquire+0x170/0x3f0 [ 2533.117497] genl_rcv+0x24/0x40 [ 2533.120768] netlink_unicast+0x437/0x610 [ 2533.124830] ? netlink_sendskb+0xd0/0xd0 [ 2533.128888] ? __check_object_size+0x179/0x230 [ 2533.133467] netlink_sendmsg+0x648/0xbc0 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6cd5a7abec37c7a66e9"]}) [ 2533.137525] ? nlmsg_notify+0x1b0/0x1b0 [ 2533.141497] ? kernel_recvmsg+0x210/0x210 [ 2533.145637] ? security_socket_sendmsg+0x83/0xb0 [ 2533.150415] ? nlmsg_notify+0x1b0/0x1b0 [ 2533.154383] sock_sendmsg+0xb5/0x100 [ 2533.158096] ___sys_sendmsg+0x6c8/0x800 [ 2533.162322] ? get_pid_task+0x91/0x130 [ 2533.166204] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2533.170958] ? lock_downgrade+0x740/0x740 [ 2533.175105] ? __fget+0x23e/0x3e0 [ 2533.178554] ? lock_acquire+0x170/0x3f0 [ 2533.182529] ? lock_downgrade+0x740/0x740 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.186682] ? __fget+0x265/0x3e0 [ 2533.190132] ? __fdget+0x19b/0x1f0 [ 2533.193670] ? sockfd_lookup_light+0xb2/0x160 [ 2533.198161] __sys_sendmsg+0xa3/0x120 [ 2533.201958] ? SyS_shutdown+0x160/0x160 [ 2533.205930] ? wait_for_completion_io+0x10/0x10 [ 2533.210598] ? SyS_read+0x210/0x210 [ 2533.214303] ? __do_page_fault+0x159/0xad0 [ 2533.218540] SyS_sendmsg+0x27/0x40 [ 2533.222070] ? __sys_sendmsg+0x120/0x120 [ 2533.226126] do_syscall_64+0x1d5/0x640 [ 2533.230012] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2533.235191] RIP: 0033:0x7fc05f6a20e9 12:32:34 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 28) 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.238889] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2533.246595] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2533.253850] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2533.261094] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2533.268338] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2533.275582] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2533.284336] nbd: failed to add new device 12:32:34 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x0) 12:32:34 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_DEV(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) (async, rerun: 64) syz_open_dev$amidi(&(0x7f0000000180), 0x2, 0x41) (async) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:34 executing program 3: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000280)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x0, 0x6, 0x2, @dev={0xfe, 0x80, '\x00', 0x34}, @dev={0xfe, 0x80, '\x00', 0xdb}, 0x7800, 0x7800, 0x2, 0xdf}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x5ad000, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r1, 0x400, 0x70bd2c, 0x400, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x72aa01e60000}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c0}, 0x20008080) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400), 0x802, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x7}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x5e}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x48040}, 0x8015) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0xc080) 12:32:34 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000240)={'syztnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x4, 0x3, 0x4, 0x81, 0x4, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x80, 0x200, 0x5}}) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'sit0\x00', r3, 0x4, 0x8, 0x4, 0x44a, 0x0, @private1, @local, 0x1, 0x20, 0x7, 0x8}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000280)={'syztnl2\x00', r4, 0x4, 0x8, 0xff, 0x20, 0x48, @private0, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x40, 0xc0, 0x1, 0x3}}) [ 2533.351140] FAULT_INJECTION: forcing a failure. [ 2533.351140] name failslab, interval 1, probability 0, space 0, times 0 12:32:34 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.402190] CPU: 1 PID: 2998 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2533.410000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2533.419357] Call Trace: [ 2533.421944] dump_stack+0x1b2/0x281 [ 2533.425573] should_fail.cold+0x10a/0x149 [ 2533.429720] should_failslab+0xd6/0x130 [ 2533.433690] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2533.438361] blk_alloc_queue_stats+0x3c/0x100 [ 2533.442853] blk_alloc_queue_node+0x125/0xb40 [ 2533.447349] blk_mq_init_queue+0x42/0x90 12:32:35 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.451408] nbd_dev_add+0x2c6/0x800 [ 2533.455117] ? nbd_send_cmd+0x11f0/0x11f0 [ 2533.459260] ? ns_capable_common+0x127/0x150 [ 2533.463663] nbd_genl_connect+0x3a4/0x1400 [ 2533.467891] ? lock_acquire+0x170/0x3f0 [ 2533.471859] ? nbd_xmit_timeout+0x500/0x500 [ 2533.476178] ? validate_nla+0x192/0x5e0 [ 2533.480148] ? nla_parse+0x157/0x1f0 [ 2533.483863] genl_family_rcv_msg+0x572/0xb20 [ 2533.488276] ? genl_rcv+0x40/0x40 [ 2533.491730] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2533.497184] ? __kmalloc_node_track_caller+0x4c/0x70 12:32:35 executing program 5: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.502292] ? trace_hardirqs_on+0x10/0x10 [ 2533.506530] genl_rcv_msg+0xaf/0x140 [ 2533.510237] netlink_rcv_skb+0x125/0x390 [ 2533.514291] ? genl_family_rcv_msg+0xb20/0xb20 [ 2533.518863] ? netlink_ack+0x9a0/0x9a0 [ 2533.522748] ? lock_acquire+0x170/0x3f0 [ 2533.526726] genl_rcv+0x24/0x40 [ 2533.529996] netlink_unicast+0x437/0x610 [ 2533.534056] ? netlink_sendskb+0xd0/0xd0 [ 2533.538112] ? __check_object_size+0x179/0x230 [ 2533.542690] netlink_sendmsg+0x648/0xbc0 [ 2533.546747] ? nlmsg_notify+0x1b0/0x1b0 12:32:35 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.550712] ? kernel_recvmsg+0x210/0x210 [ 2533.554852] ? security_socket_sendmsg+0x83/0xb0 [ 2533.559603] ? nlmsg_notify+0x1b0/0x1b0 [ 2533.563571] sock_sendmsg+0xb5/0x100 [ 2533.567283] ___sys_sendmsg+0x6c8/0x800 [ 2533.571252] ? get_pid_task+0x91/0x130 [ 2533.575133] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2533.579891] ? lock_downgrade+0x740/0x740 [ 2533.584033] ? __fget+0x23e/0x3e0 [ 2533.587482] ? lock_acquire+0x170/0x3f0 [ 2533.591450] ? lock_downgrade+0x740/0x740 [ 2533.595596] ? __fget+0x265/0x3e0 [ 2533.599051] ? __fdget+0x19b/0x1f0 12:32:35 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2533.602585] ? sockfd_lookup_light+0xb2/0x160 [ 2533.607076] __sys_sendmsg+0xa3/0x120 [ 2533.610881] ? SyS_shutdown+0x160/0x160 [ 2533.614870] ? wait_for_completion_io+0x10/0x10 [ 2533.619540] ? SyS_read+0x210/0x210 [ 2533.623164] ? __do_page_fault+0x159/0xad0 [ 2533.627395] SyS_sendmsg+0x27/0x40 [ 2533.630925] ? __sys_sendmsg+0x120/0x120 [ 2533.634984] do_syscall_64+0x1d5/0x640 [ 2533.638875] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2533.644061] RIP: 0033:0x7fc05f6a20e9 [ 2533.647761] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2533.655464] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2533.662724] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2533.669990] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2533.677251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2533.684600] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:35 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 29) 12:32:35 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:35 executing program 3: ioctl$sock_ipv6_tunnel_SIOCGETPRL(0xffffffffffffffff, 0x89f4, &(0x7f0000000200)={'syztnl2\x00', &(0x7f0000000280)={'ip6gre0\x00', 0x0, 0x29, 0x1, 0x0, 0x6, 0x2, @dev={0xfe, 0x80, '\x00', 0x34}, @dev={0xfe, 0x80, '\x00', 0xdb}, 0x7800, 0x7800, 0x2, 0xdf}}) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x5ad000, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r1, 0x400, 0x70bd2c, 0x400, {}, [@L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x72aa01e60000}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c0}, 0x20008080) (async) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000400), 0x802, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r5, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r3, &(0x7f0000000540)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_COOKIE={0xc, 0xf, 0x7}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e21}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x5e}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x48040}, 0x8015) (async) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000300), 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x28, 0x0, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_TYPE={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000000}, 0xc080) 12:32:35 executing program 4: r0 = socket$inet6(0xa, 0x6, 0x9) getsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="11051a74bbfd24bb04dcd5050df02a005ba7e12d939e10300d4821ead04cb6632b50581abfe5b18c4502302d44fe2a9c5cbf2cf645b52fa40e17c52166dd0f5010103d144b6f83adae4add26443cc8dd27c824ff1a47b6ce3e35a0", @ANYRES32=0x0, @ANYBLOB="0008000102000000000000004500001400000000002f9078000000007f000001"]}) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) 12:32:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40086af45a3562b2d40e8925f6"]}) [ 2533.710864] nbd: failed to add new device 12:32:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x3, 0x4) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) [ 2533.811724] netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. 12:32:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x3, 0x4) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000040)=0x3, 0x4) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) [ 2533.861397] FAULT_INJECTION: forcing a failure. [ 2533.861397] name failslab, interval 1, probability 0, space 0, times 0 [ 2533.890381] CPU: 1 PID: 3076 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2533.898194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2533.907544] Call Trace: [ 2533.910130] dump_stack+0x1b2/0x281 [ 2533.913773] should_fail.cold+0x10a/0x149 [ 2533.917935] should_failslab+0xd6/0x130 [ 2533.921916] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2533.927022] blkg_alloc+0x92/0x5c0 [ 2533.930569] blkcg_init_queue+0x23/0x410 [ 2533.934633] blk_alloc_queue_node+0x826/0xb40 [ 2533.939130] blk_mq_init_queue+0x42/0x90 [ 2533.943189] nbd_dev_add+0x2c6/0x800 [ 2533.946899] ? nbd_send_cmd+0x11f0/0x11f0 [ 2533.951059] ? ns_capable_common+0x127/0x150 [ 2533.955468] nbd_genl_connect+0x3a4/0x1400 12:32:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) [ 2533.959706] ? lock_acquire+0x170/0x3f0 [ 2533.963677] ? nbd_xmit_timeout+0x500/0x500 [ 2533.968000] ? validate_nla+0x192/0x5e0 [ 2533.971967] ? nla_parse+0x157/0x1f0 [ 2533.975675] genl_family_rcv_msg+0x572/0xb20 [ 2533.980073] ? genl_rcv+0x40/0x40 [ 2533.983531] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2533.988979] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2533.994077] ? trace_hardirqs_on+0x10/0x10 [ 2533.998313] genl_rcv_msg+0xaf/0x140 [ 2534.002021] netlink_rcv_skb+0x125/0x390 [ 2534.006073] ? genl_family_rcv_msg+0xb20/0xb20 12:32:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) [ 2534.010648] ? netlink_ack+0x9a0/0x9a0 [ 2534.014703] ? lock_acquire+0x170/0x3f0 [ 2534.018677] genl_rcv+0x24/0x40 [ 2534.021943] netlink_unicast+0x437/0x610 [ 2534.025993] ? netlink_sendskb+0xd0/0xd0 [ 2534.030049] ? __check_object_size+0x179/0x230 [ 2534.034629] netlink_sendmsg+0x648/0xbc0 [ 2534.038686] ? nlmsg_notify+0x1b0/0x1b0 [ 2534.042654] ? kernel_recvmsg+0x210/0x210 [ 2534.046798] ? security_socket_sendmsg+0x83/0xb0 [ 2534.051550] ? nlmsg_notify+0x1b0/0x1b0 [ 2534.055521] sock_sendmsg+0xb5/0x100 [ 2534.059231] ___sys_sendmsg+0x6c8/0x800 [ 2534.063191] ? get_pid_task+0x91/0x130 [ 2534.067064] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2534.071814] ? lock_downgrade+0x740/0x740 [ 2534.075959] ? __fget+0x23e/0x3e0 [ 2534.079409] ? lock_acquire+0x170/0x3f0 [ 2534.083375] ? lock_downgrade+0x740/0x740 [ 2534.087531] ? __fget+0x265/0x3e0 [ 2534.090974] ? __fdget+0x19b/0x1f0 [ 2534.094501] ? sockfd_lookup_light+0xb2/0x160 [ 2534.098983] __sys_sendmsg+0xa3/0x120 [ 2534.102762] ? SyS_shutdown+0x160/0x160 [ 2534.106720] ? wait_for_completion_io+0x10/0x10 [ 2534.111369] ? SyS_read+0x210/0x210 [ 2534.114970] ? __do_page_fault+0x159/0xad0 [ 2534.119184] SyS_sendmsg+0x27/0x40 [ 2534.122701] ? __sys_sendmsg+0x120/0x120 [ 2534.126745] do_syscall_64+0x1d5/0x640 [ 2534.130615] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2534.135803] RIP: 0033:0x7fc05f6a20e9 [ 2534.139498] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2534.147183] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2534.154427] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2534.161673] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2534.168924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2534.176169] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2534.188387] nbd: failed to add new device 12:32:35 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 30) 12:32:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x30, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x48c0}, 0x4) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) 12:32:35 executing program 4: r0 = socket$inet6(0xa, 0x6, 0x9) getsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="11051a74bbfd24bb04dcd5050df02a005ba7e12d939e10300d4821ead04cb6632b50581abfe5b18c4502302d44fe2a9c5cbf2cf645b52fa40e17c52166dd0f5010103d144b6f83adae4add26443cc8dd27c824ff1a47b6ce3e35a0", @ANYRES32=0x0, @ANYBLOB="0008000102000000000000004500001400000000002f9078000000007f000001"]}) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) socket$inet6(0xa, 0x6, 0x9) (async) getsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="11051a74bbfd24bb04dcd5050df02a005ba7e12d939e10300d4821ead04cb6632b50581abfe5b18c4502302d44fe2a9c5cbf2cf645b52fa40e17c52166dd0f5010103d144b6f83adae4add26443cc8dd27c824ff1a47b6ce3e35a0", @ANYRES32=0x0, @ANYBLOB="0008000102000000000000004500001400000000002f9078000000007f000001"]}) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) (async) 12:32:35 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) r4 = socket$inet6(0xa, 0x6, 0x170f) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20008001) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5db133c67ec365d365f2dce168605c", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) 12:32:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x48c0}, 0x4) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) 12:32:35 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:35 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) [ 2534.343642] FAULT_INJECTION: forcing a failure. [ 2534.343642] name failslab, interval 1, probability 0, space 0, times 0 [ 2534.381173] CPU: 0 PID: 3129 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2534.388988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2534.398339] Call Trace: [ 2534.400926] dump_stack+0x1b2/0x281 [ 2534.404557] should_fail.cold+0x10a/0x149 [ 2534.408705] should_failslab+0xd6/0x130 [ 2534.412677] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2534.417779] blk_throtl_init+0x7a/0x590 [ 2534.421839] blkcg_init_queue+0x18f/0x410 [ 2534.425987] blk_alloc_queue_node+0x826/0xb40 [ 2534.430480] blk_mq_init_queue+0x42/0x90 [ 2534.434539] nbd_dev_add+0x2c6/0x800 [ 2534.438248] ? nbd_send_cmd+0x11f0/0x11f0 [ 2534.442387] ? ns_capable_common+0x127/0x150 [ 2534.446774] nbd_genl_connect+0x3a4/0x1400 [ 2534.450983] ? lock_acquire+0x170/0x3f0 [ 2534.454949] ? nbd_xmit_timeout+0x500/0x500 [ 2534.459268] ? validate_nla+0x192/0x5e0 [ 2534.463241] ? nla_parse+0x157/0x1f0 [ 2534.466954] genl_family_rcv_msg+0x572/0xb20 [ 2534.471360] ? genl_rcv+0x40/0x40 [ 2534.474808] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2534.480250] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2534.485333] ? trace_hardirqs_on+0x10/0x10 [ 2534.489554] genl_rcv_msg+0xaf/0x140 [ 2534.493248] netlink_rcv_skb+0x125/0x390 [ 2534.497285] ? genl_family_rcv_msg+0xb20/0xb20 [ 2534.501846] ? netlink_ack+0x9a0/0x9a0 [ 2534.505717] ? lock_acquire+0x170/0x3f0 [ 2534.509670] genl_rcv+0x24/0x40 [ 2534.512926] netlink_unicast+0x437/0x610 [ 2534.516964] ? netlink_sendskb+0xd0/0xd0 [ 2534.520999] ? __check_object_size+0x179/0x230 [ 2534.525556] netlink_sendmsg+0x648/0xbc0 [ 2534.529595] ? nlmsg_notify+0x1b0/0x1b0 [ 2534.533545] ? kernel_recvmsg+0x210/0x210 [ 2534.537757] ? security_socket_sendmsg+0x83/0xb0 [ 2534.543451] ? nlmsg_notify+0x1b0/0x1b0 [ 2534.547399] sock_sendmsg+0xb5/0x100 [ 2534.551093] ___sys_sendmsg+0x6c8/0x800 [ 2534.555046] ? get_pid_task+0x91/0x130 [ 2534.558923] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2534.563656] ? lock_downgrade+0x740/0x740 [ 2534.567781] ? __fget+0x23e/0x3e0 [ 2534.571214] ? lock_acquire+0x170/0x3f0 [ 2534.575163] ? lock_downgrade+0x740/0x740 [ 2534.579287] ? __fget+0x265/0x3e0 [ 2534.582719] ? __fdget+0x19b/0x1f0 [ 2534.586240] ? sockfd_lookup_light+0xb2/0x160 [ 2534.590720] __sys_sendmsg+0xa3/0x120 [ 2534.594495] ? SyS_shutdown+0x160/0x160 [ 2534.598446] ? wait_for_completion_io+0x10/0x10 [ 2534.603094] ? SyS_read+0x210/0x210 [ 2534.606694] ? __do_page_fault+0x159/0xad0 [ 2534.610908] SyS_sendmsg+0x27/0x40 [ 2534.614426] ? __sys_sendmsg+0x120/0x120 [ 2534.618463] do_syscall_64+0x1d5/0x640 [ 2534.622328] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2534.627496] RIP: 0033:0x7fc05f6a20e9 [ 2534.631186] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) [ 2534.638884] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2534.646139] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2534.653383] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2534.660629] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2534.667875] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923", @ANYRES32=0x0]}) 12:32:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x48c0}, 0x4) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x5}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'bridge_slave_1\x00'}]}, 0x30}, 0x1, 0x0, 0x0, 0x48c0}, 0x4) (async) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) 12:32:36 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 31) 12:32:36 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x64, r1, 0x0, 0x70bd29, 0x25dfdbff, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_RECV_SEQ={0x5, 0x12, 0x4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x1}, @L2TP_ATTR_MRU={0x6, 0x1d, 0x3}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x3f}, @L2TP_ATTR_PEER_COOKIE={0xc, 0x10, 0x7}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x884}, 0x20000004) 12:32:36 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) r4 = socket$inet6(0xa, 0x6, 0x170f) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20008001) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5db133c67ec365d365f2dce168605c", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) socket$inet6(0xa, 0x6, 0x170f) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20008001) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5db133c67ec365d365f2dce168605c", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) (async) 12:32:36 executing program 4: r0 = socket$inet6(0xa, 0x6, 0x9) getsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000100)) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'syztnl1\x00', &(0x7f00000001c0)=ANY=[@ANYBLOB="11051a74bbfd24bb04dcd5050df02a005ba7e12d939e10300d4821ead04cb6632b50581abfe5b18c4502302d44fe2a9c5cbf2cf645b52fa40e17c52166dd0f5010103d144b6f83adae4add26443cc8dd27c824ff1a47b6ce3e35a0", @ANYRES32=0x0, @ANYBLOB="0008000102000000000000004500001400000000002f9078000000007f000001"]}) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r1) [ 2534.717331] nbd: failed to add new device 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d722ddf65e52c2f2b62d73a1688afc05e52272eaf594777f3e381f95381772063c10167d4d82205a2cd1b71fa58ef15db4993f8923"]}) [ 2534.804256] FAULT_INJECTION: forcing a failure. [ 2534.804256] name failslab, interval 1, probability 0, space 0, times 0 [ 2534.832730] CPU: 0 PID: 3174 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2534.840544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2534.849891] Call Trace: [ 2534.852478] dump_stack+0x1b2/0x281 [ 2534.856113] should_fail.cold+0x10a/0x149 [ 2534.860263] should_failslab+0xd6/0x130 [ 2534.864248] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2534.869353] throtl_pd_alloc+0x59/0x990 [ 2534.873337] ? throtl_add_bio_tg+0x1e0/0x1e0 [ 2534.877756] blkcg_activate_policy+0x115/0x5c0 [ 2534.882338] ? rcu_read_lock_sched_held+0x16c/0x1d0 [ 2534.887364] blk_throtl_init+0x408/0x590 [ 2534.891426] blkcg_init_queue+0x18f/0x410 [ 2534.895572] blk_alloc_queue_node+0x826/0xb40 [ 2534.900067] blk_mq_init_queue+0x42/0x90 [ 2534.904123] nbd_dev_add+0x2c6/0x800 [ 2534.907846] ? nbd_send_cmd+0x11f0/0x11f0 [ 2534.911991] ? ns_capable_common+0x127/0x150 [ 2534.916394] nbd_genl_connect+0x3a4/0x1400 [ 2534.920626] ? lock_acquire+0x170/0x3f0 [ 2534.924594] ? nbd_xmit_timeout+0x500/0x500 [ 2534.928912] ? validate_nla+0x192/0x5e0 [ 2534.932882] ? nla_parse+0x157/0x1f0 [ 2534.936594] genl_family_rcv_msg+0x572/0xb20 [ 2534.940999] ? genl_rcv+0x40/0x40 [ 2534.944447] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2534.949893] ? __kmalloc_node_track_caller+0x4c/0x70 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) [ 2534.954998] ? trace_hardirqs_on+0x10/0x10 [ 2534.959236] genl_rcv_msg+0xaf/0x140 [ 2534.962944] netlink_rcv_skb+0x125/0x390 [ 2534.966999] ? genl_family_rcv_msg+0xb20/0xb20 [ 2534.971574] ? netlink_ack+0x9a0/0x9a0 [ 2534.975459] ? lock_acquire+0x170/0x3f0 [ 2534.979437] genl_rcv+0x24/0x40 [ 2534.982713] netlink_unicast+0x437/0x610 [ 2534.986770] ? netlink_sendskb+0xd0/0xd0 [ 2534.990824] ? __check_object_size+0x179/0x230 [ 2534.995405] netlink_sendmsg+0x648/0xbc0 [ 2534.999465] ? nlmsg_notify+0x1b0/0x1b0 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00'}) 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2535.003435] ? kernel_recvmsg+0x210/0x210 [ 2535.007589] ? security_socket_sendmsg+0x83/0xb0 [ 2535.012338] ? nlmsg_notify+0x1b0/0x1b0 [ 2535.016314] sock_sendmsg+0xb5/0x100 [ 2535.020029] ___sys_sendmsg+0x6c8/0x800 [ 2535.024002] ? get_pid_task+0x91/0x130 [ 2535.027884] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2535.032636] ? lock_downgrade+0x740/0x740 [ 2535.036818] ? __fget+0x23e/0x3e0 [ 2535.040284] ? lock_acquire+0x170/0x3f0 [ 2535.044269] ? lock_downgrade+0x740/0x740 [ 2535.048420] ? __fget+0x265/0x3e0 [ 2535.051885] ? __fdget+0x19b/0x1f0 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2535.055423] ? sockfd_lookup_light+0xb2/0x160 [ 2535.059927] __sys_sendmsg+0xa3/0x120 [ 2535.063724] ? SyS_shutdown+0x160/0x160 [ 2535.067695] ? wait_for_completion_io+0x10/0x10 [ 2535.072454] ? SyS_read+0x210/0x210 [ 2535.076073] ? __do_page_fault+0x159/0xad0 [ 2535.080311] SyS_sendmsg+0x27/0x40 [ 2535.083848] ? __sys_sendmsg+0x120/0x120 [ 2535.087911] do_syscall_64+0x1d5/0x640 [ 2535.091800] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2535.096980] RIP: 0033:0x7fc05f6a20e9 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB]}) [ 2535.100681] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2535.108381] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2535.115660] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2535.122919] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2535.130200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2535.137468] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:36 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) r4 = socket$inet6(0xa, 0x6, 0x170f) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x60, r3, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_SESSION_ID={0x8}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r4}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0x2}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000}, 0x20008001) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="5db133c67ec365d365f2dce168605c", @ANYRES16=r1, @ANYBLOB="0100000000000800000008"], 0x20}}, 0x0) [ 2535.174640] nbd: failed to add new device 12:32:36 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 32) 12:32:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x10, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48881}, 0x8010) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x8, 0x9, 0x4, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x700, 0x7800, 0x1, 0x4}}) 12:32:36 executing program 1: syz_open_dev$amidi(&(0x7f0000000000), 0x7, 0x10b041) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0xd28) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) mq_timedreceive(r1, &(0x7f0000000040)=""/16, 0x10, 0x3, 0x0) read$midi(r0, &(0x7f0000000180)=""/221, 0xdd) socket$inet6_dccp(0xa, 0x6, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000280)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xa, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x16}, {[@timestamp={0x44, 0x14, 0x31, 0x0, 0x7, [0x0, 0x4, 0x9, 0x3f]}]}}}}}) 12:32:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, r3, 0x308, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40850) 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d527470502ed3ada821312e4a16ceef3fa7ab5eae935f733a3af5d7"]}) 12:32:36 executing program 3: r0 = epoll_create1(0x0) r1 = inotify_init1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000800"], 0x20}}, 0x0) 12:32:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x10, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48881}, 0x8010) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x8, 0x9, 0x4, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x700, 0x7800, 0x1, 0x4}}) 12:32:36 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, r3, 0x308, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40850) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, r3, 0x308, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40850) (async) 12:32:36 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) 12:32:36 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2535.313572] FAULT_INJECTION: forcing a failure. [ 2535.313572] name failslab, interval 1, probability 0, space 0, times 0 [ 2535.325005] CPU: 0 PID: 3251 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2535.332797] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2535.342150] Call Trace: [ 2535.344744] dump_stack+0x1b2/0x281 [ 2535.348380] should_fail.cold+0x10a/0x149 [ 2535.352540] should_failslab+0xd6/0x130 [ 2535.356513] kmem_cache_alloc_node_trace+0x58/0x400 [ 2535.361531] throtl_pd_alloc+0x59/0x990 [ 2535.365509] ? throtl_add_bio_tg+0x1e0/0x1e0 [ 2535.369913] blkcg_activate_policy+0x23e/0x5c0 [ 2535.374500] blk_throtl_init+0x408/0x590 [ 2535.378566] blkcg_init_queue+0x18f/0x410 [ 2535.382714] blk_alloc_queue_node+0x826/0xb40 [ 2535.387216] blk_mq_init_queue+0x42/0x90 [ 2535.391275] nbd_dev_add+0x2c6/0x800 [ 2535.394989] ? nbd_send_cmd+0x11f0/0x11f0 [ 2535.399139] ? ns_capable_common+0x127/0x150 [ 2535.403551] nbd_genl_connect+0x3a4/0x1400 [ 2535.407779] ? lock_acquire+0x170/0x3f0 [ 2535.411754] ? nbd_xmit_timeout+0x500/0x500 [ 2535.416072] ? validate_nla+0x192/0x5e0 [ 2535.420046] ? nla_parse+0x157/0x1f0 [ 2535.423933] genl_family_rcv_msg+0x572/0xb20 [ 2535.428339] ? genl_rcv+0x40/0x40 [ 2535.431796] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2535.437244] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2535.442340] ? trace_hardirqs_on+0x10/0x10 [ 2535.446575] genl_rcv_msg+0xaf/0x140 [ 2535.450383] netlink_rcv_skb+0x125/0x390 [ 2535.454444] ? genl_family_rcv_msg+0xb20/0xb20 [ 2535.459031] ? netlink_ack+0x9a0/0x9a0 12:32:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2535.462914] ? lock_acquire+0x170/0x3f0 [ 2535.466890] genl_rcv+0x24/0x40 [ 2535.470177] netlink_unicast+0x437/0x610 [ 2535.474234] ? netlink_sendskb+0xd0/0xd0 [ 2535.478294] ? __check_object_size+0x179/0x230 [ 2535.482969] netlink_sendmsg+0x648/0xbc0 [ 2535.487030] ? nlmsg_notify+0x1b0/0x1b0 [ 2535.490998] ? kernel_recvmsg+0x210/0x210 [ 2535.495143] ? security_socket_sendmsg+0x83/0xb0 [ 2535.499903] ? nlmsg_notify+0x1b0/0x1b0 [ 2535.503872] sock_sendmsg+0xb5/0x100 [ 2535.507584] ___sys_sendmsg+0x6c8/0x800 12:32:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2535.511555] ? get_pid_task+0x91/0x130 [ 2535.515439] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2535.520193] ? lock_downgrade+0x740/0x740 [ 2535.524346] ? __fget+0x23e/0x3e0 [ 2535.527801] ? lock_acquire+0x170/0x3f0 [ 2535.531775] ? lock_downgrade+0x740/0x740 [ 2535.535923] ? __fget+0x265/0x3e0 [ 2535.539376] ? __fdget+0x19b/0x1f0 [ 2535.542910] ? sockfd_lookup_light+0xb2/0x160 [ 2535.547400] __sys_sendmsg+0xa3/0x120 [ 2535.551196] ? SyS_shutdown+0x160/0x160 [ 2535.555168] ? wait_for_completion_io+0x10/0x10 [ 2535.559840] ? SyS_read+0x210/0x210 [ 2535.563464] ? __do_page_fault+0x159/0xad0 [ 2535.567786] SyS_sendmsg+0x27/0x40 [ 2535.571416] ? __sys_sendmsg+0x120/0x120 [ 2535.575470] do_syscall_64+0x1d5/0x640 [ 2535.579498] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2535.584685] RIP: 0033:0x7fc05f6a20e9 [ 2535.588495] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2535.596188] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2535.603436] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2535.610692] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2535.617948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2535.625206] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:37 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 33) 12:32:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559ba9d52"]}) 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x10, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48881}, 0x8010) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x8, 0x9, 0x4, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x700, 0x7800, 0x1, 0x4}}) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, 0x0, 0x10, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x48881}, 0x8010) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f00000000c0)={'ip6_vti0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x8, 0x9, 0x4, 0x20, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, 0x700, 0x7800, 0x1, 0x4}}) (async) 12:32:37 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r2, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'syztnl0\x00', r2, 0x2f, 0x19, 0x7, 0x0, 0x13, @local, @empty, 0x40, 0x7800, 0xc2, 0x80000000}}) 12:32:37 executing program 3: r0 = epoll_create1(0x0) r1 = inotify_init1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000800"], 0x20}}, 0x0) 12:32:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) pipe2$watch_queue(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, r3, 0x308, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40850) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) pipe2$watch_queue(&(0x7f0000000000), 0x80) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x5c, r3, 0x308, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_ORIG_INTERVAL={0x8}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x5}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x2}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x8}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000080}, 0x40850) (async) 12:32:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) [ 2535.750591] FAULT_INJECTION: forcing a failure. [ 2535.750591] name failslab, interval 1, probability 0, space 0, times 0 [ 2535.782663] CPU: 0 PID: 3302 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2535.790573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x8, &(0x7f0000000040)=0xfffffffc, 0x4) [ 2535.799923] Call Trace: [ 2535.802510] dump_stack+0x1b2/0x281 [ 2535.806139] should_fail.cold+0x10a/0x149 [ 2535.810291] should_failslab+0xd6/0x130 [ 2535.814275] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2535.818944] ? blk_mq_can_queue+0x40/0x40 [ 2535.823088] ? queue_set_hctx_shared+0x210/0x210 [ 2535.827840] blk_stat_alloc_callback+0x54/0x2f0 [ 2535.832511] blk_mq_init_allocated_queue+0x80/0xfd0 [ 2535.837531] ? blkcg_init_queue+0x19f/0x410 [ 2535.841848] ? blk_alloc_queue_node+0x82f/0xb40 [ 2535.846521] blk_mq_init_queue+0x5a/0x90 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x8, &(0x7f0000000040)=0xfffffffc, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x8, &(0x7f0000000040)=0xfffffffc, 0x4) (async) 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x8, &(0x7f0000000040)=0xfffffffc, 0x4) [ 2535.850582] nbd_dev_add+0x2c6/0x800 [ 2535.854290] ? nbd_send_cmd+0x11f0/0x11f0 [ 2535.858434] ? ns_capable_common+0x127/0x150 [ 2535.862910] nbd_genl_connect+0x3a4/0x1400 [ 2535.867139] ? lock_acquire+0x170/0x3f0 [ 2535.871123] ? nbd_xmit_timeout+0x500/0x500 [ 2535.875446] ? validate_nla+0x192/0x5e0 [ 2535.879421] ? nla_parse+0x157/0x1f0 [ 2535.883142] genl_family_rcv_msg+0x572/0xb20 [ 2535.887549] ? genl_rcv+0x40/0x40 [ 2535.891000] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040), 0x4) [ 2535.896447] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2535.901638] ? trace_hardirqs_on+0x10/0x10 [ 2535.905880] genl_rcv_msg+0xaf/0x140 [ 2535.909593] netlink_rcv_skb+0x125/0x390 [ 2535.913655] ? genl_family_rcv_msg+0xb20/0xb20 [ 2535.918234] ? netlink_ack+0x9a0/0x9a0 [ 2535.922117] ? lock_acquire+0x170/0x3f0 [ 2535.926089] genl_rcv+0x24/0x40 [ 2535.929367] netlink_unicast+0x437/0x610 [ 2535.933429] ? netlink_sendskb+0xd0/0xd0 [ 2535.937486] ? __check_object_size+0x179/0x230 [ 2535.942067] netlink_sendmsg+0x648/0xbc0 [ 2535.946139] ? nlmsg_notify+0x1b0/0x1b0 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040), 0x4) [ 2535.950112] ? kernel_recvmsg+0x210/0x210 [ 2535.954265] ? security_socket_sendmsg+0x83/0xb0 [ 2535.959019] ? nlmsg_notify+0x1b0/0x1b0 [ 2535.962989] sock_sendmsg+0xb5/0x100 [ 2535.966702] ___sys_sendmsg+0x6c8/0x800 [ 2535.970680] ? get_pid_task+0x91/0x130 [ 2535.974567] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2535.979321] ? lock_downgrade+0x740/0x740 [ 2535.983467] ? __fget+0x23e/0x3e0 [ 2535.986918] ? lock_acquire+0x170/0x3f0 [ 2535.990884] ? lock_downgrade+0x740/0x740 [ 2535.995031] ? __fget+0x265/0x3e0 [ 2535.998484] ? __fdget+0x19b/0x1f0 [ 2536.002022] ? sockfd_lookup_light+0xb2/0x160 [ 2536.006516] __sys_sendmsg+0xa3/0x120 [ 2536.010312] ? SyS_shutdown+0x160/0x160 [ 2536.014282] ? wait_for_completion_io+0x10/0x10 [ 2536.018961] ? SyS_read+0x210/0x210 [ 2536.022593] ? __do_page_fault+0x159/0xad0 [ 2536.026829] SyS_sendmsg+0x27/0x40 [ 2536.030362] ? __sys_sendmsg+0x120/0x120 [ 2536.034420] do_syscall_64+0x1d5/0x640 [ 2536.038307] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2536.043489] RIP: 0033:0x7fc05f6a20e9 [ 2536.047196] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2536.054899] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2536.066764] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2536.074101] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2536.081351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2536.088600] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:37 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 34) 12:32:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000040), 0x4) (async) 12:32:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) 12:32:37 executing program 3: r0 = epoll_create1(0x0) r1 = inotify_init1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f00000000c0)) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000800"], 0x20}}, 0x0) 12:32:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2536.141135] nbd: failed to add new device 12:32:37 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:37 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) 12:32:37 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:37 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) [ 2536.230267] FAULT_INJECTION: forcing a failure. [ 2536.230267] name failslab, interval 1, probability 0, space 0, times 0 [ 2536.268866] CPU: 1 PID: 3358 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2536.276682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2536.286028] Call Trace: [ 2536.288617] dump_stack+0x1b2/0x281 [ 2536.292249] should_fail.cold+0x10a/0x149 [ 2536.296397] should_failslab+0xd6/0x130 [ 2536.300370] __kmalloc+0x2c1/0x400 [ 2536.303907] ? blk_stat_alloc_callback+0x81/0x2f0 [ 2536.308747] ? blk_mq_can_queue+0x40/0x40 [ 2536.312890] ? queue_set_hctx_shared+0x210/0x210 [ 2536.317643] blk_stat_alloc_callback+0x81/0x2f0 [ 2536.322310] blk_mq_init_allocated_queue+0x80/0xfd0 [ 2536.327323] ? blkcg_init_queue+0x19f/0x410 [ 2536.331636] ? blk_alloc_queue_node+0x82f/0xb40 [ 2536.336301] blk_mq_init_queue+0x5a/0x90 [ 2536.340360] nbd_dev_add+0x2c6/0x800 [ 2536.344082] ? nbd_send_cmd+0x11f0/0x11f0 [ 2536.348229] ? ns_capable_common+0x127/0x150 [ 2536.352637] nbd_genl_connect+0x3a4/0x1400 [ 2536.356865] ? lock_acquire+0x170/0x3f0 [ 2536.360838] ? nbd_xmit_timeout+0x500/0x500 [ 2536.365155] ? validate_nla+0x192/0x5e0 [ 2536.369133] ? nla_parse+0x157/0x1f0 [ 2536.372845] genl_family_rcv_msg+0x572/0xb20 [ 2536.377253] ? genl_rcv+0x40/0x40 [ 2536.380707] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2536.386155] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2536.391254] ? trace_hardirqs_on+0x10/0x10 [ 2536.395479] genl_rcv_msg+0xaf/0x140 [ 2536.399170] netlink_rcv_skb+0x125/0x390 [ 2536.403205] ? genl_family_rcv_msg+0xb20/0xb20 [ 2536.407769] ? netlink_ack+0x9a0/0x9a0 [ 2536.411645] ? lock_acquire+0x170/0x3f0 [ 2536.415604] genl_rcv+0x24/0x40 [ 2536.418858] netlink_unicast+0x437/0x610 [ 2536.422896] ? netlink_sendskb+0xd0/0xd0 [ 2536.426950] ? __check_object_size+0x179/0x230 [ 2536.431518] netlink_sendmsg+0x648/0xbc0 [ 2536.435558] ? nlmsg_notify+0x1b0/0x1b0 [ 2536.439507] ? kernel_recvmsg+0x210/0x210 [ 2536.443641] ? security_socket_sendmsg+0x83/0xb0 [ 2536.448380] ? nlmsg_notify+0x1b0/0x1b0 [ 2536.452338] sock_sendmsg+0xb5/0x100 [ 2536.456026] ___sys_sendmsg+0x6c8/0x800 [ 2536.459977] ? get_pid_task+0x91/0x130 [ 2536.463849] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2536.468598] ? lock_downgrade+0x740/0x740 [ 2536.472731] ? __fget+0x23e/0x3e0 [ 2536.476161] ? lock_acquire+0x170/0x3f0 [ 2536.480109] ? lock_downgrade+0x740/0x740 [ 2536.484235] ? __fget+0x265/0x3e0 [ 2536.487674] ? __fdget+0x19b/0x1f0 [ 2536.491210] ? sockfd_lookup_light+0xb2/0x160 [ 2536.495687] __sys_sendmsg+0xa3/0x120 [ 2536.499468] ? SyS_shutdown+0x160/0x160 [ 2536.503422] ? wait_for_completion_io+0x10/0x10 [ 2536.508084] ? SyS_read+0x210/0x210 [ 2536.511698] ? __do_page_fault+0x159/0xad0 [ 2536.515912] SyS_sendmsg+0x27/0x40 [ 2536.519427] ? __sys_sendmsg+0x120/0x120 [ 2536.523466] do_syscall_64+0x1d5/0x640 12:32:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB='@']}) 12:32:38 executing program 1: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) [ 2536.527344] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2536.532516] RIP: 0033:0x7fc05f6a20e9 [ 2536.536203] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2536.543897] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2536.551144] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2536.558395] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2536.565652] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2536.572906] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:38 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 35) 12:32:38 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x1) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) [ 2536.595712] nbd: failed to add new device 12:32:38 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x58}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffd}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffc01}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0xff7f}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000007af0c21cddf49db1ddd194d5532b92d9b85e51e238aee5998009d0c0e1496c3e", @ANYRES16=r3, @ANYBLOB="20002cbd7000fcdbdf250400000006002800030000000800320006000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000014}, 0x11) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r8, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYRESHEX=r4, @ANYRESOCT=r1, @ANYRESDEC=r6, @ANYRES16=r3, @ANYBLOB="3cd8ccd5683f3629ad4f7edf881fef8480a4e4397f3304a66809b8b032384b0095a307ab15f793afe2e7479ec4885657cf1d399a37c87a1c2cb24c6824c52d62a1a65c049cc37b280b6f90496e284522801d3dc9e10cf6b0cee615f28732593d5f41243ce082230f67f1dc05c0a95e7a23f133c5844e4c66b6d3b5658612f18718c8fccf7fd940c47d557ca8dba66a6a3e8ea17792cb1fa842431f802b99d611317df03bcb97c98a3708fbfe95d285407d18d06ef01827b184441d40c5896a0150f78e7030ce08f6926ed8172e09df036b5c08662bf0629361185b51dcbb10be6b4fc3440cb55a4b92fa055daca2da029f47", @ANYRESDEC=r5, @ANYRESDEC=r2, @ANYRESHEX=r7, @ANYRES32=r0, @ANYRES64=r8], 0x20}}, 0x0) 12:32:38 executing program 1: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98"]}) 12:32:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x130}}, 0x0) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='security.apparmor\x00', 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140007020000009078e0000001ac1414aa"]}) 12:32:38 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x58}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffd}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffc01}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0xff7f}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000007af0c21cddf49db1ddd194d5532b92d9b85e51e238aee5998009d0c0e1496c3e", @ANYRES16=r3, @ANYBLOB="20002cbd7000fcdbdf250400000006002800030000000800320006000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000014}, 0x11) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) (async) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r8, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYRESHEX=r4, @ANYRESOCT=r1, @ANYRESDEC=r6, @ANYRES16=r3, @ANYBLOB="3cd8ccd5683f3629ad4f7edf881fef8480a4e4397f3304a66809b8b032384b0095a307ab15f793afe2e7479ec4885657cf1d399a37c87a1c2cb24c6824c52d62a1a65c049cc37b280b6f90496e284522801d3dc9e10cf6b0cee615f28732593d5f41243ce082230f67f1dc05c0a95e7a23f133c5844e4c66b6d3b5658612f18718c8fccf7fd940c47d557ca8dba66a6a3e8ea17792cb1fa842431f802b99d611317df03bcb97c98a3708fbfe95d285407d18d06ef01827b184441d40c5896a0150f78e7030ce08f6926ed8172e09df036b5c08662bf0629361185b51dcbb10be6b4fc3440cb55a4b92fa055daca2da029f47", @ANYRESDEC=r5, @ANYRESDEC=r2, @ANYRESHEX=r7, @ANYRES32=r0, @ANYRES64=r8], 0x20}}, 0x0) 12:32:38 executing program 1: ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:38 executing program 0: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000080)=0x1) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98"]}) [ 2536.684122] FAULT_INJECTION: forcing a failure. [ 2536.684122] name failslab, interval 1, probability 0, space 0, times 0 [ 2536.752798] CPU: 1 PID: 3400 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2536.760605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2536.769952] Call Trace: [ 2536.772541] dump_stack+0x1b2/0x281 [ 2536.776173] should_fail.cold+0x10a/0x149 [ 2536.780322] should_failslab+0xd6/0x130 [ 2536.784295] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2536.789398] __kmalloc_node+0x38/0x70 [ 2536.793199] blk_mq_init_allocated_queue+0x17b/0xfd0 [ 2536.798299] ? blkcg_init_queue+0x19f/0x410 [ 2536.802617] ? blk_alloc_queue_node+0x82f/0xb40 [ 2536.807282] blk_mq_init_queue+0x5a/0x90 [ 2536.811345] nbd_dev_add+0x2c6/0x800 [ 2536.819221] ? nbd_send_cmd+0x11f0/0x11f0 [ 2536.823366] ? ns_capable_common+0x127/0x150 [ 2536.827772] nbd_genl_connect+0x3a4/0x1400 [ 2536.832005] ? lock_acquire+0x170/0x3f0 [ 2536.835979] ? nbd_xmit_timeout+0x500/0x500 [ 2536.840295] ? validate_nla+0x192/0x5e0 [ 2536.844267] ? nla_parse+0x157/0x1f0 [ 2536.847978] genl_family_rcv_msg+0x572/0xb20 [ 2536.852386] ? genl_rcv+0x40/0x40 [ 2536.855840] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2536.861295] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2536.866396] ? trace_hardirqs_on+0x10/0x10 [ 2536.870633] genl_rcv_msg+0xaf/0x140 [ 2536.874344] netlink_rcv_skb+0x125/0x390 [ 2536.878402] ? genl_family_rcv_msg+0xb20/0xb20 [ 2536.882977] ? netlink_ack+0x9a0/0x9a0 [ 2536.886860] ? lock_acquire+0x170/0x3f0 [ 2536.890832] genl_rcv+0x24/0x40 [ 2536.894107] netlink_unicast+0x437/0x610 [ 2536.898169] ? netlink_sendskb+0xd0/0xd0 12:32:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x130}}, 0x0) (async) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='security.apparmor\x00', 0x0, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140007020000009078e0000001ac1414aa"]}) [ 2536.902226] ? __check_object_size+0x179/0x230 [ 2536.906805] netlink_sendmsg+0x648/0xbc0 [ 2536.910872] ? nlmsg_notify+0x1b0/0x1b0 [ 2536.914837] ? kernel_recvmsg+0x210/0x210 [ 2536.918981] ? security_socket_sendmsg+0x83/0xb0 [ 2536.923730] ? nlmsg_notify+0x1b0/0x1b0 [ 2536.927699] sock_sendmsg+0xb5/0x100 [ 2536.931407] ___sys_sendmsg+0x6c8/0x800 [ 2536.935375] ? get_pid_task+0x91/0x130 [ 2536.939256] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2536.944028] ? lock_downgrade+0x740/0x740 [ 2536.948180] ? __fget+0x23e/0x3e0 [ 2536.951630] ? lock_acquire+0x170/0x3f0 [ 2536.955599] ? lock_downgrade+0x740/0x740 [ 2536.959745] ? __fget+0x265/0x3e0 [ 2536.963198] ? __fdget+0x19b/0x1f0 [ 2536.966739] ? sockfd_lookup_light+0xb2/0x160 [ 2536.971232] __sys_sendmsg+0xa3/0x120 [ 2536.975018] ? SyS_shutdown+0x160/0x160 [ 2536.978972] ? wait_for_completion_io+0x10/0x10 [ 2536.983622] ? SyS_read+0x210/0x210 [ 2536.987228] ? __do_page_fault+0x159/0xad0 [ 2536.991456] SyS_sendmsg+0x27/0x40 [ 2536.994974] ? __sys_sendmsg+0x120/0x120 [ 2536.999013] do_syscall_64+0x1d5/0x640 [ 2537.002968] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2537.008131] RIP: 0033:0x7fc05f6a20e9 [ 2537.011819] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2537.019503] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2537.026750] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2537.034003] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2537.041250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 12:32:38 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 36) 12:32:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_mount_image$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x130}}, 0x0) (async) lsetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='security.apparmor\x00', 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140007020000009078e0000001ac1414aa"]}) 12:32:38 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98"]}) 12:32:38 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:38 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0x58}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0xfffffffd}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0xfffffc01}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0xff7f}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) (async) r4 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r5, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000400)=ANY=[@ANYBLOB="240000007af0c21cddf49db1ddd194d5532b92d9b85e51e238aee5998009d0c0e1496c3e", @ANYRES16=r3, @ANYBLOB="20002cbd7000fcdbdf250400000006002800030000000800320006000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000014}, 0x11) sendmsg$BATADV_CMD_GET_GATEWAYS(r4, 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000300)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r6 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r6, 0x0, 0x0) (async) r7 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r7, 0x0, 0x0) r8 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r8, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYRESHEX=r4, @ANYRESOCT=r1, @ANYRESDEC=r6, @ANYRES16=r3, @ANYBLOB="3cd8ccd5683f3629ad4f7edf881fef8480a4e4397f3304a66809b8b032384b0095a307ab15f793afe2e7479ec4885657cf1d399a37c87a1c2cb24c6824c52d62a1a65c049cc37b280b6f90496e284522801d3dc9e10cf6b0cee615f28732593d5f41243ce082230f67f1dc05c0a95e7a23f133c5844e4c66b6d3b5658612f18718c8fccf7fd940c47d557ca8dba66a6a3e8ea17792cb1fa842431f802b99d611317df03bcb97c98a3708fbfe95d285407d18d06ef01827b184441d40c5896a0150f78e7030ce08f6926ed8172e09df036b5c08662bf0629361185b51dcbb10be6b4fc3440cb55a4b92fa055daca2da029f47", @ANYRESDEC=r5, @ANYRESDEC=r2, @ANYRESHEX=r7, @ANYRES32=r0, @ANYRES64=r8], 0x20}}, 0x0) [ 2537.048494] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2537.067092] nbd: failed to add new device 12:32:38 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0={0xfc, 0x0, '\x00', 0x1}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x13}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4010}, 0x800) 12:32:38 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) 12:32:38 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) 12:32:38 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:38 executing program 1: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00000000000045000014003f0000"]}) [ 2537.172752] FAULT_INJECTION: forcing a failure. [ 2537.172752] name failslab, interval 1, probability 0, space 0, times 0 [ 2537.221466] CPU: 1 PID: 3457 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2537.229303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2537.238651] Call Trace: [ 2537.241241] dump_stack+0x1b2/0x281 [ 2537.244871] should_fail.cold+0x10a/0x149 [ 2537.249022] should_failslab+0xd6/0x130 [ 2537.252996] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2537.258099] __kmalloc_node+0x38/0x70 [ 2537.261900] blk_mq_realloc_hw_ctxs+0x1a5/0xe00 [ 2537.266566] ? rcu_read_lock_sched_held+0x16c/0x1d0 12:32:38 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) [ 2537.271580] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 2537.276858] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 2537.281955] ? blkcg_init_queue+0x19f/0x410 [ 2537.286273] ? blk_alloc_queue_node+0x82f/0xb40 [ 2537.290938] blk_mq_init_queue+0x5a/0x90 [ 2537.294996] nbd_dev_add+0x2c6/0x800 [ 2537.298703] ? nbd_send_cmd+0x11f0/0x11f0 [ 2537.302848] ? ns_capable_common+0x127/0x150 [ 2537.307255] nbd_genl_connect+0x3a4/0x1400 [ 2537.311488] ? lock_acquire+0x170/0x3f0 [ 2537.315469] ? nbd_xmit_timeout+0x500/0x500 [ 2537.319793] ? validate_nla+0x192/0x5e0 [ 2537.323781] ? nla_parse+0x157/0x1f0 [ 2537.327511] genl_family_rcv_msg+0x572/0xb20 [ 2537.331933] ? genl_rcv+0x40/0x40 [ 2537.335383] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2537.340835] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2537.345930] ? trace_hardirqs_on+0x10/0x10 [ 2537.350168] genl_rcv_msg+0xaf/0x140 [ 2537.353883] netlink_rcv_skb+0x125/0x390 [ 2537.357941] ? genl_family_rcv_msg+0xb20/0xb20 [ 2537.362517] ? netlink_ack+0x9a0/0x9a0 [ 2537.366482] ? lock_acquire+0x170/0x3f0 [ 2537.370452] genl_rcv+0x24/0x40 [ 2537.373765] netlink_unicast+0x437/0x610 [ 2537.377820] ? netlink_sendskb+0xd0/0xd0 [ 2537.381875] ? __check_object_size+0x179/0x230 [ 2537.386456] netlink_sendmsg+0x648/0xbc0 [ 2537.390514] ? nlmsg_notify+0x1b0/0x1b0 [ 2537.394482] ? kernel_recvmsg+0x210/0x210 [ 2537.398628] ? security_socket_sendmsg+0x83/0xb0 [ 2537.403377] ? nlmsg_notify+0x1b0/0x1b0 [ 2537.407352] sock_sendmsg+0xb5/0x100 [ 2537.411061] ___sys_sendmsg+0x6c8/0x800 [ 2537.415035] ? get_pid_task+0x91/0x130 [ 2537.418917] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2537.423669] ? lock_downgrade+0x740/0x740 [ 2537.427816] ? __fget+0x23e/0x3e0 [ 2537.431272] ? lock_acquire+0x170/0x3f0 [ 2537.435243] ? lock_downgrade+0x740/0x740 [ 2537.439382] ? __fget+0x265/0x3e0 [ 2537.442828] ? __fdget+0x19b/0x1f0 [ 2537.446354] ? sockfd_lookup_light+0xb2/0x160 [ 2537.450930] __sys_sendmsg+0xa3/0x120 [ 2537.454709] ? SyS_shutdown+0x160/0x160 [ 2537.458666] ? wait_for_completion_io+0x10/0x10 [ 2537.463314] ? SyS_read+0x210/0x210 [ 2537.466918] ? __do_page_fault+0x159/0xad0 [ 2537.471133] SyS_sendmsg+0x27/0x40 [ 2537.474648] ? __sys_sendmsg+0x120/0x120 [ 2537.478689] do_syscall_64+0x1d5/0x640 [ 2537.482560] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2537.487723] RIP: 0033:0x7fc05f6a20e9 [ 2537.491408] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2537.499091] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2537.506339] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2537.513735] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:39 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 37) 12:32:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0={0xfc, 0x0, '\x00', 0x1}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x13}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4010}, 0x800) 12:32:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) [ 2537.520983] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2537.528232] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2537.546253] nbd: failed to add new device 12:32:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0x3, 0x8, 0x1, 0x61, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7, 0x1, 0x80000001, 0x7fff}}) 12:32:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, 0x0) 12:32:39 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x9, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40840}, 0x1) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="ba5608bc8447be093d1a7be0bda3c6b5bca8206009d6e7ec7350347b7c89fcf312d7617c11f1dc0946b9f88783db1ceef13f92b9ea701cf114f8dc2174b1a32147e3ee594e038d3da5f10d9617d60000000020000007d4795e114221608ed75557afcf12f96f88099f298ebccf5cd66e585d3ca114e49b2a4cd5ce8b42b6ad82f637f7c15e6a6a61079b73000000e900"/153, @ANYRESHEX=r1, @ANYRESHEX=r0, @ANYRESHEX=r1], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 12:32:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) [ 2537.623045] FAULT_INJECTION: forcing a failure. [ 2537.623045] name failslab, interval 1, probability 0, space 0, times 0 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0x4c, 0x0, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @private0={0xfc, 0x0, '\x00', 0x1}}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @dev={0xac, 0x14, 0x14, 0x13}}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @L2TP_ATTR_L2SPEC_TYPE={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4010}, 0x800) [ 2537.663259] CPU: 1 PID: 3500 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2537.671071] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2537.680509] Call Trace: [ 2537.683103] dump_stack+0x1b2/0x281 [ 2537.686736] should_fail.cold+0x10a/0x149 [ 2537.690886] should_failslab+0xd6/0x130 [ 2537.694860] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2537.699964] __kmalloc_node+0x38/0x70 [ 2537.703762] blk_mq_realloc_hw_ctxs+0x528/0xe00 [ 2537.708441] blk_mq_init_allocated_queue+0x20c/0xfd0 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="65720000000000003cb4000000000000", @ANYRES32=r0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aaede26b2e257e0391bc4403a371d4c793acf48ed0f80d7fac1f122e616c684fdd7a53c61edb6938d0c25a698511c7280e42b1d14d4fd51e70dd88d3535b55be6d46a9e089ca388826ecf156613b32b448721a5317972c1157"]}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0xc042}, 0x4008040) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) getegid() [ 2537.713543] ? blkcg_init_queue+0x19f/0x410 [ 2537.717859] ? blk_alloc_queue_node+0x82f/0xb40 [ 2537.722529] blk_mq_init_queue+0x5a/0x90 [ 2537.726589] nbd_dev_add+0x2c6/0x800 [ 2537.730299] ? nbd_send_cmd+0x11f0/0x11f0 [ 2537.734443] ? ns_capable_common+0x127/0x150 [ 2537.738850] nbd_genl_connect+0x3a4/0x1400 [ 2537.743075] ? lock_acquire+0x170/0x3f0 [ 2537.747047] ? nbd_xmit_timeout+0x500/0x500 [ 2537.751364] ? validate_nla+0x192/0x5e0 [ 2537.755341] ? nla_parse+0x157/0x1f0 [ 2537.759084] genl_family_rcv_msg+0x572/0xb20 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="65720000000000003cb4000000000000", @ANYRES32=r0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aaede26b2e257e0391bc4403a371d4c793acf48ed0f80d7fac1f122e616c684fdd7a53c61edb6938d0c25a698511c7280e42b1d14d4fd51e70dd88d3535b55be6d46a9e089ca388826ecf156613b32b448721a5317972c1157"]}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0xc042}, 0x4008040) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) getegid() socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="65720000000000003cb4000000000000", @ANYRES32=r0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aaede26b2e257e0391bc4403a371d4c793acf48ed0f80d7fac1f122e616c684fdd7a53c61edb6938d0c25a698511c7280e42b1d14d4fd51e70dd88d3535b55be6d46a9e089ca388826ecf156613b32b448721a5317972c1157"]}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0xc042}, 0x4008040) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) (async) getegid() (async) [ 2537.763491] ? genl_rcv+0x40/0x40 [ 2537.766946] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2537.772395] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2537.777491] ? trace_hardirqs_on+0x10/0x10 [ 2537.781736] genl_rcv_msg+0xaf/0x140 [ 2537.785448] netlink_rcv_skb+0x125/0x390 [ 2537.789511] ? genl_family_rcv_msg+0xb20/0xb20 [ 2537.794088] ? netlink_ack+0x9a0/0x9a0 [ 2537.797970] ? lock_acquire+0x170/0x3f0 [ 2537.801942] genl_rcv+0x24/0x40 [ 2537.805218] netlink_unicast+0x437/0x610 [ 2537.809279] ? netlink_sendskb+0xd0/0xd0 [ 2537.813332] ? __check_object_size+0x179/0x230 [ 2537.817996] netlink_sendmsg+0x648/0xbc0 [ 2537.822053] ? nlmsg_notify+0x1b0/0x1b0 [ 2537.826022] ? kernel_recvmsg+0x210/0x210 [ 2537.830166] ? security_socket_sendmsg+0x83/0xb0 [ 2537.834917] ? nlmsg_notify+0x1b0/0x1b0 [ 2537.838886] sock_sendmsg+0xb5/0x100 [ 2537.842594] ___sys_sendmsg+0x6c8/0x800 [ 2537.846565] ? get_pid_task+0x91/0x130 [ 2537.850536] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2537.855286] ? lock_downgrade+0x740/0x740 [ 2537.859442] ? __fget+0x23e/0x3e0 [ 2537.862892] ? lock_acquire+0x170/0x3f0 [ 2537.866949] ? lock_downgrade+0x740/0x740 [ 2537.871098] ? __fget+0x265/0x3e0 [ 2537.874548] ? __fdget+0x19b/0x1f0 [ 2537.878086] ? sockfd_lookup_light+0xb2/0x160 [ 2537.882581] __sys_sendmsg+0xa3/0x120 [ 2537.886378] ? SyS_shutdown+0x160/0x160 [ 2537.890352] ? wait_for_completion_io+0x10/0x10 [ 2537.895037] ? SyS_read+0x210/0x210 [ 2537.898661] ? __do_page_fault+0x159/0xad0 [ 2537.902888] SyS_sendmsg+0x27/0x40 [ 2537.906424] ? __sys_sendmsg+0x120/0x120 [ 2537.910478] do_syscall_64+0x1d5/0x640 [ 2537.914371] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2537.919551] RIP: 0033:0x7fc05f6a20e9 [ 2537.923253] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2537.930954] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2537.938216] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2537.945477] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2537.952742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2537.960009] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2537.980968] nbd: failed to add new device 12:32:39 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 38) 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="65720000000000003cb4000000000000", @ANYRES32=r0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aaede26b2e257e0391bc4403a371d4c793acf48ed0f80d7fac1f122e616c684fdd7a53c61edb6938d0c25a698511c7280e42b1d14d4fd51e70dd88d3535b55be6d46a9e089ca388826ecf156613b32b448721a5317972c1157"]}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0xc042}, 0x4008040) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) getegid() socket$nl_generic(0x10, 0x3, 0x10) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="65720000000000003cb4000000000000", @ANYRES32=r0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aaede26b2e257e0391bc4403a371d4c793acf48ed0f80d7fac1f122e616c684fdd7a53c61edb6938d0c25a698511c7280e42b1d14d4fd51e70dd88d3535b55be6d46a9e089ca388826ecf156613b32b448721a5317972c1157"]}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, 0x0, 0x800, 0x70bd2c, 0x25dfdbfe, {}, [@NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x28}, 0x1, 0x0, 0x0, 0xc042}, 0x4008040) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) write$RDMA_USER_CM_CMD_DESTROY_ID(r2, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) (async) getegid() (async) 12:32:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf559"]}) 12:32:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0x3, 0x8, 0x1, 0x61, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7, 0x1, 0x80000001, 0x7fff}}) 12:32:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:39 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (rerun: 64) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x9, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40840}, 0x1) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="ba5608bc8447be093d1a7be0bda3c6b5bca8206009d6e7ec7350347b7c89fcf312d7617c11f1dc0946b9f88783db1ceef13f92b9ea701cf114f8dc2174b1a32147e3ee594e038d3da5f10d9617d60000000020000007d4795e114221608ed75557afcf12f96f88099f298ebccf5cd66e585d3ca114e49b2a4cd5ce8b42b6ad82f637f7c15e6a6a61079b73000000e900"/153, @ANYRESHEX=r1, @ANYRESHEX=r0, @ANYRESHEX=r1], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 12:32:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) 12:32:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) 12:32:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r1, 0x89f8, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'sit0\x00', 0x0, 0x4, 0x3, 0x8, 0x1, 0x61, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x7, 0x1, 0x80000001, 0x7fff}}) 12:32:39 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_timedsend(r0, &(0x7f0000000180)="45789fcf84eb68edc76318f88d845f68b9a003a451f9bbd47c4fd3689e73a7bfda4e4a34ccadf3035c7047afcfa56a977086dba26b68565f3b1fd54ef5e108325b21228625cba00817b477e12d8d9ba18a1c613c8656eed40ab883ca95aac1db05783435f0058e127f80bc1c504612b9d707b7c282bd695701bb60fe07bfe71832acd1e40e593128adbc149072b5ee7a77a49675500787b988b85fc68dfd679329d46da8cb070cd9be4245817ea1273ce9229dc748b694151cbde55a39d75d60e7ee59a44fe64d8bd5c589d8", 0xcc, 0x800, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:39 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', 0x0}) [ 2538.104590] FAULT_INJECTION: forcing a failure. [ 2538.104590] name failslab, interval 1, probability 0, space 0, times 0 12:32:39 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) [ 2538.161888] CPU: 0 PID: 3554 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2538.169697] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2538.179050] Call Trace: [ 2538.181650] dump_stack+0x1b2/0x281 [ 2538.185291] should_fail.cold+0x10a/0x149 [ 2538.189441] should_failslab+0xd6/0x130 [ 2538.193413] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2538.198516] __kmalloc_node+0x38/0x70 [ 2538.202317] blk_mq_realloc_hw_ctxs+0x528/0xe00 [ 2538.206995] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 2538.212111] ? blkcg_init_queue+0x19f/0x410 [ 2538.216433] ? blk_alloc_queue_node+0x82f/0xb40 [ 2538.221098] blk_mq_init_queue+0x5a/0x90 [ 2538.225155] nbd_dev_add+0x2c6/0x800 [ 2538.228860] ? nbd_send_cmd+0x11f0/0x11f0 [ 2538.233026] ? ns_capable_common+0x127/0x150 [ 2538.237432] nbd_genl_connect+0x3a4/0x1400 [ 2538.241661] ? lock_acquire+0x170/0x3f0 [ 2538.245631] ? nbd_xmit_timeout+0x500/0x500 [ 2538.249950] ? validate_nla+0x192/0x5e0 [ 2538.253921] ? nla_parse+0x157/0x1f0 [ 2538.257636] genl_family_rcv_msg+0x572/0xb20 [ 2538.262055] ? genl_rcv+0x40/0x40 [ 2538.265509] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2538.270956] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2538.276059] ? trace_hardirqs_on+0x10/0x10 [ 2538.280300] genl_rcv_msg+0xaf/0x140 [ 2538.284001] netlink_rcv_skb+0x125/0x390 [ 2538.288036] ? genl_family_rcv_msg+0xb20/0xb20 [ 2538.292597] ? netlink_ack+0x9a0/0x9a0 [ 2538.296460] ? lock_acquire+0x170/0x3f0 [ 2538.300415] genl_rcv+0x24/0x40 [ 2538.303670] netlink_unicast+0x437/0x610 [ 2538.307713] ? netlink_sendskb+0xd0/0xd0 [ 2538.311752] ? __check_object_size+0x179/0x230 [ 2538.316404] netlink_sendmsg+0x648/0xbc0 [ 2538.320445] ? nlmsg_notify+0x1b0/0x1b0 [ 2538.324397] ? kernel_recvmsg+0x210/0x210 [ 2538.328526] ? security_socket_sendmsg+0x83/0xb0 [ 2538.333254] ? nlmsg_notify+0x1b0/0x1b0 [ 2538.337201] sock_sendmsg+0xb5/0x100 [ 2538.340890] ___sys_sendmsg+0x6c8/0x800 [ 2538.344837] ? get_pid_task+0x91/0x130 [ 2538.348703] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2538.353436] ? lock_downgrade+0x740/0x740 [ 2538.357567] ? __fget+0x23e/0x3e0 [ 2538.361004] ? lock_acquire+0x170/0x3f0 [ 2538.364953] ? lock_downgrade+0x740/0x740 [ 2538.369078] ? __fget+0x265/0x3e0 [ 2538.372508] ? __fdget+0x19b/0x1f0 [ 2538.376026] ? sockfd_lookup_light+0xb2/0x160 [ 2538.380498] __sys_sendmsg+0xa3/0x120 [ 2538.384272] ? SyS_shutdown+0x160/0x160 [ 2538.388225] ? wait_for_completion_io+0x10/0x10 [ 2538.392873] ? SyS_read+0x210/0x210 [ 2538.396477] ? __do_page_fault+0x159/0xad0 [ 2538.400687] SyS_sendmsg+0x27/0x40 [ 2538.404204] ? __sys_sendmsg+0x120/0x120 [ 2538.408245] do_syscall_64+0x1d5/0x640 [ 2538.412122] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2538.417295] RIP: 0033:0x7fc05f6a20e9 [ 2538.420984] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2538.428668] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2538.435914] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2538.443162] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2538.450408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 12:32:40 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 39) 12:32:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_timedsend(r0, &(0x7f0000000180)="45789fcf84eb68edc76318f88d845f68b9a003a451f9bbd47c4fd3689e73a7bfda4e4a34ccadf3035c7047afcfa56a977086dba26b68565f3b1fd54ef5e108325b21228625cba00817b477e12d8d9ba18a1c613c8656eed40ab883ca95aac1db05783435f0058e127f80bc1c504612b9d707b7c282bd695701bb60fe07bfe71832acd1e40e593128adbc149072b5ee7a77a49675500787b988b85fc68dfd679329d46da8cb070cd9be4245817ea1273ce9229dc748b694151cbde55a39d75d60e7ee59a44fe64d8bd5c589d8", 0xcc, 0x800, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bc"]}) 12:32:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8, 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0xfff) 12:32:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0]}) [ 2538.457654] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2538.466928] nbd: failed to add new device [ 2538.599617] FAULT_INJECTION: forcing a failure. [ 2538.599617] name failslab, interval 1, probability 0, space 0, times 0 [ 2538.621671] CPU: 1 PID: 3600 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2538.629480] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2538.638828] Call Trace: [ 2538.641419] dump_stack+0x1b2/0x281 [ 2538.645049] should_fail.cold+0x10a/0x149 [ 2538.649205] should_failslab+0xd6/0x130 [ 2538.653188] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2538.658297] blk_alloc_flush_queue+0x4f/0x2b0 [ 2538.662789] blk_mq_realloc_hw_ctxs+0x6ab/0xe00 [ 2538.667441] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 2538.672522] ? blkcg_init_queue+0x19f/0x410 [ 2538.676928] ? blk_alloc_queue_node+0x82f/0xb40 [ 2538.681581] blk_mq_init_queue+0x5a/0x90 [ 2538.685621] nbd_dev_add+0x2c6/0x800 [ 2538.689310] ? nbd_send_cmd+0x11f0/0x11f0 [ 2538.693436] ? ns_capable_common+0x127/0x150 [ 2538.697820] nbd_genl_connect+0x3a4/0x1400 [ 2538.702030] ? lock_acquire+0x170/0x3f0 [ 2538.705993] ? nbd_xmit_timeout+0x500/0x500 [ 2538.710292] ? validate_nla+0x192/0x5e0 [ 2538.714302] ? nla_parse+0x157/0x1f0 [ 2538.718002] genl_family_rcv_msg+0x572/0xb20 [ 2538.722388] ? genl_rcv+0x40/0x40 [ 2538.725827] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2538.731268] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2538.736349] ? trace_hardirqs_on+0x10/0x10 [ 2538.740577] genl_rcv_msg+0xaf/0x140 [ 2538.744269] netlink_rcv_skb+0x125/0x390 [ 2538.748304] ? genl_family_rcv_msg+0xb20/0xb20 [ 2538.752860] ? netlink_ack+0x9a0/0x9a0 [ 2538.756724] ? lock_acquire+0x170/0x3f0 [ 2538.760677] genl_rcv+0x24/0x40 [ 2538.763936] netlink_unicast+0x437/0x610 [ 2538.767974] ? netlink_sendskb+0xd0/0xd0 [ 2538.772012] ? __check_object_size+0x179/0x230 [ 2538.776567] netlink_sendmsg+0x648/0xbc0 [ 2538.780604] ? nlmsg_notify+0x1b0/0x1b0 [ 2538.784556] ? kernel_recvmsg+0x210/0x210 [ 2538.788681] ? security_socket_sendmsg+0x83/0xb0 [ 2538.793413] ? nlmsg_notify+0x1b0/0x1b0 [ 2538.797362] sock_sendmsg+0xb5/0x100 [ 2538.801054] ___sys_sendmsg+0x6c8/0x800 [ 2538.805002] ? get_pid_task+0x91/0x130 [ 2538.808862] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2538.813596] ? lock_downgrade+0x740/0x740 [ 2538.817720] ? __fget+0x23e/0x3e0 [ 2538.821236] ? lock_acquire+0x170/0x3f0 [ 2538.825183] ? lock_downgrade+0x740/0x740 [ 2538.829309] ? __fget+0x265/0x3e0 [ 2538.832737] ? __fdget+0x19b/0x1f0 [ 2538.836252] ? sockfd_lookup_light+0xb2/0x160 [ 2538.840730] __sys_sendmsg+0xa3/0x120 [ 2538.844718] ? SyS_shutdown+0x160/0x160 [ 2538.848675] ? wait_for_completion_io+0x10/0x10 [ 2538.853331] ? SyS_read+0x210/0x210 [ 2538.856937] ? __do_page_fault+0x159/0xad0 [ 2538.861158] SyS_sendmsg+0x27/0x40 [ 2538.864682] ? __sys_sendmsg+0x120/0x120 [ 2538.868725] do_syscall_64+0x1d5/0x640 [ 2538.872682] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2538.877933] RIP: 0033:0x7fc05f6a20e9 [ 2538.881631] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2538.889322] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 12:32:40 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r4, 0x1}, 0x14}}, 0x0) (async) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r4, 0x9, 0x70bd27, 0x25dfdbff, {}, [@BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40840}, 0x1) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="ba5608bc8447be093d1a7be0bda3c6b5bca8206009d6e7ec7350347b7c89fcf312d7617c11f1dc0946b9f88783db1ceef13f92b9ea701cf114f8dc2174b1a32147e3ee594e038d3da5f10d9617d60000000020000007d4795e114221608ed75557afcf12f96f88099f298ebccf5cd66e585d3ca114e49b2a4cd5ce8b42b6ad82f637f7c15e6a6a61079b73000000e900"/153, @ANYRESHEX=r1, @ANYRESHEX=r0, @ANYRESHEX=r1], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 12:32:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) mq_timedsend(r0, &(0x7f0000000180)="45789fcf84eb68edc76318f88d845f68b9a003a451f9bbd47c4fd3689e73a7bfda4e4a34ccadf3035c7047afcfa56a977086dba26b68565f3b1fd54ef5e108325b21228625cba00817b477e12d8d9ba18a1c613c8656eed40ab883ca95aac1db05783435f0058e127f80bc1c504612b9d707b7c282bd695701bb60fe07bfe71832acd1e40e593128adbc149072b5ee7a77a49675500787b988b85fc68dfd679329d46da8cb070cd9be4245817ea1273ce9229dc748b694151cbde55a39d75d60e7ee59a44fe64d8bd5c589d8", 0xcc, 0x800, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8, 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0xfff) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8, 0x4) (async) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0xfff) (async) 12:32:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0]}) 12:32:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) 12:32:40 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 40) [ 2538.896655] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2538.903972] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2538.911217] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2538.918463] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2538.936742] nbd: failed to add new device 12:32:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0]}) 12:32:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8, 0x4) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0xfff) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000040)=0x8, 0x4) (async) ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0xfff) (async) 12:32:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfb"]}) 12:32:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 12:32:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB]}) [ 2539.030212] FAULT_INJECTION: forcing a failure. [ 2539.030212] name failslab, interval 1, probability 0, space 0, times 0 [ 2539.064549] CPU: 1 PID: 3622 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2539.072355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2539.081709] Call Trace: [ 2539.084293] dump_stack+0x1b2/0x281 [ 2539.087926] should_fail.cold+0x10a/0x149 [ 2539.092083] should_failslab+0xd6/0x130 [ 2539.096056] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2539.101157] __kmalloc_node+0x38/0x70 [ 2539.104955] sbitmap_init_node+0x10c/0x3d0 [ 2539.109190] blk_mq_realloc_hw_ctxs+0x59b/0xe00 [ 2539.113868] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 2539.118966] ? blkcg_init_queue+0x19f/0x410 [ 2539.123367] ? blk_alloc_queue_node+0x82f/0xb40 [ 2539.128033] blk_mq_init_queue+0x5a/0x90 [ 2539.132090] nbd_dev_add+0x2c6/0x800 [ 2539.135802] ? nbd_send_cmd+0x11f0/0x11f0 [ 2539.139947] ? ns_capable_common+0x127/0x150 [ 2539.144353] nbd_genl_connect+0x3a4/0x1400 [ 2539.148578] ? lock_acquire+0x170/0x3f0 [ 2539.152554] ? nbd_xmit_timeout+0x500/0x500 [ 2539.156873] ? validate_nla+0x192/0x5e0 [ 2539.160846] ? nla_parse+0x157/0x1f0 [ 2539.164560] genl_family_rcv_msg+0x572/0xb20 [ 2539.168971] ? genl_rcv+0x40/0x40 [ 2539.172419] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 12:32:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfb"]}) [ 2539.177867] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2539.182963] ? trace_hardirqs_on+0x10/0x10 [ 2539.187205] genl_rcv_msg+0xaf/0x140 [ 2539.190923] netlink_rcv_skb+0x125/0x390 [ 2539.194977] ? genl_family_rcv_msg+0xb20/0xb20 [ 2539.199552] ? netlink_ack+0x9a0/0x9a0 [ 2539.203441] ? lock_acquire+0x170/0x3f0 [ 2539.207424] genl_rcv+0x24/0x40 [ 2539.210695] netlink_unicast+0x437/0x610 [ 2539.214749] ? netlink_sendskb+0xd0/0xd0 [ 2539.218803] ? __check_object_size+0x179/0x230 [ 2539.223379] netlink_sendmsg+0x648/0xbc0 [ 2539.227442] ? nlmsg_notify+0x1b0/0x1b0 [ 2539.231405] ? kernel_recvmsg+0x210/0x210 [ 2539.235556] ? security_socket_sendmsg+0x83/0xb0 [ 2539.240303] ? nlmsg_notify+0x1b0/0x1b0 [ 2539.244273] sock_sendmsg+0xb5/0x100 [ 2539.247980] ___sys_sendmsg+0x6c8/0x800 [ 2539.251951] ? get_pid_task+0x91/0x130 [ 2539.255828] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2539.260579] ? lock_downgrade+0x740/0x740 [ 2539.264723] ? __fget+0x23e/0x3e0 [ 2539.268173] ? lock_acquire+0x170/0x3f0 [ 2539.272145] ? lock_downgrade+0x740/0x740 [ 2539.276295] ? __fget+0x265/0x3e0 [ 2539.279743] ? __fdget+0x19b/0x1f0 [ 2539.283285] ? sockfd_lookup_light+0xb2/0x160 [ 2539.287779] __sys_sendmsg+0xa3/0x120 [ 2539.291574] ? SyS_shutdown+0x160/0x160 [ 2539.295548] ? wait_for_completion_io+0x10/0x10 [ 2539.300217] ? SyS_read+0x210/0x210 [ 2539.303845] ? __do_page_fault+0x159/0xad0 [ 2539.308068] SyS_sendmsg+0x27/0x40 [ 2539.311590] ? __sys_sendmsg+0x120/0x120 [ 2539.315636] do_syscall_64+0x1d5/0x640 [ 2539.319517] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2539.324691] RIP: 0033:0x7fc05f6a20e9 [ 2539.328387] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2539.336071] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2539.343317] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2539.350563] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2539.357812] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2539.365169] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:40 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB]}) 12:32:40 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfb"]}) 12:32:40 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async, rerun: 64) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) (rerun: 64) 12:32:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x123200, 0x0) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="44fbff00", @ANYRES16=0x0, @ANYBLOB="10002bbd7000ffdbdf250a00000005be37000100000008003900ffffffff05002a00000000000527983d00330001000000acfe37000100000008003100090000009a6afd033ddec05826856376f3c52d4e0bea2a47e3e374efcf2e6819889ca39fc239a37a889bd51b2025a9bb785011fa5a5fe4f234fbfba31a3aaf42ba16658cb6415550962995"], 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fbdbdf250600000006005ad0bbee32b706cef9dcb1a6e02a020000000006001c000500000005000d002000000006000100000000"], 0x3c}}, 0x0) 12:32:40 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 41) [ 2539.378748] nbd: failed to add new device 12:32:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYRESOCT=r1], 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x42}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}]}, 0x34}}, 0x4004) 12:32:41 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) (fail_nth: 1) 12:32:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x123200, 0x0) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="44fbff00", @ANYRES16=0x0, @ANYBLOB="10002bbd7000ffdbdf250a00000005be37000100000008003900ffffffff05002a00000000000527983d00330001000000acfe37000100000008003100090000009a6afd033ddec05826856376f3c52d4e0bea2a47e3e374efcf2e6819889ca39fc239a37a889bd51b2025a9bb785011fa5a5fe4f234fbfba31a3aaf42ba16658cb6415550962995"], 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fbdbdf250600000006005ad0bbee32b706cef9dcb1a6e02a020000000006001c000500000005000d002000000006000100000000"], 0x3c}}, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x123200, 0x0) (async) socket$l2tp6(0xa, 0x2, 0x73) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="44fbff00", @ANYRES16=0x0, @ANYBLOB="10002bbd7000ffdbdf250a00000005be37000100000008003900ffffffff05002a00000000000527983d00330001000000acfe37000100000008003100090000009a6afd033ddec05826856376f3c52d4e0bea2a47e3e374efcf2e6819889ca39fc239a37a889bd51b2025a9bb785011fa5a5fe4f234fbfba31a3aaf42ba16658cb6415550962995"], 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fbdbdf250600000006005ad0bbee32b706cef9dcb1a6e02a020000000006001c000500000005000d002000000006000100000000"], 0x3c}}, 0x0) (async) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ISOLATION_MARK={0x8}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB]}) [ 2539.499505] FAULT_INJECTION: forcing a failure. [ 2539.499505] name failslab, interval 1, probability 0, space 0, times 0 [ 2539.546516] CPU: 0 PID: 3672 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2539.554324] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2539.563852] Call Trace: [ 2539.566443] dump_stack+0x1b2/0x281 [ 2539.570072] should_fail.cold+0x10a/0x149 [ 2539.574229] should_failslab+0xd6/0x130 [ 2539.578205] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2539.583314] blk_alloc_flush_queue+0x4f/0x2b0 [ 2539.587806] blk_mq_realloc_hw_ctxs+0x6ab/0xe00 [ 2539.592503] blk_mq_init_allocated_queue+0x20c/0xfd0 [ 2539.597601] ? blkcg_init_queue+0x19f/0x410 [ 2539.601922] ? blk_alloc_queue_node+0x82f/0xb40 [ 2539.606588] blk_mq_init_queue+0x5a/0x90 [ 2539.610647] nbd_dev_add+0x2c6/0x800 [ 2539.614356] ? nbd_send_cmd+0x11f0/0x11f0 [ 2539.618498] ? ns_capable_common+0x127/0x150 [ 2539.622905] nbd_genl_connect+0x3a4/0x1400 [ 2539.627135] ? lock_acquire+0x170/0x3f0 [ 2539.631107] ? nbd_xmit_timeout+0x500/0x500 [ 2539.635434] ? validate_nla+0x192/0x5e0 [ 2539.639410] ? nla_parse+0x157/0x1f0 12:32:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000140), 0x123200, 0x0) socket$l2tp6(0xa, 0x2, 0x73) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="44fbff00", @ANYRES16=0x0, @ANYBLOB="10002bbd7000ffdbdf250a00000005be37000100000008003900ffffffff05002a00000000000527983d00330001000000acfe37000100000008003100090000009a6afd033ddec05826856376f3c52d4e0bea2a47e3e374efcf2e6819889ca39fc239a37a889bd51b2025a9bb785011fa5a5fe4f234fbfba31a3aaf42ba16658cb6415550962995"], 0x44}, 0x1, 0x0, 0x0, 0x20004000}, 0x20008000) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000325bd7000fbdbdf250600000006005ad0bbee32b706cef9dcb1a6e02a020000000006001c000500000005000d002000000006000100000000"], 0x3c}}, 0x0) [ 2539.643122] genl_family_rcv_msg+0x572/0xb20 [ 2539.647530] ? genl_rcv+0x40/0x40 [ 2539.650980] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2539.656433] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2539.661527] ? trace_hardirqs_on+0x10/0x10 [ 2539.665758] genl_rcv_msg+0xaf/0x140 [ 2539.669463] netlink_rcv_skb+0x125/0x390 [ 2539.673514] ? genl_family_rcv_msg+0xb20/0xb20 [ 2539.678173] ? netlink_ack+0x9a0/0x9a0 [ 2539.682051] ? lock_acquire+0x170/0x3f0 [ 2539.686027] genl_rcv+0x24/0x40 [ 2539.689301] netlink_unicast+0x437/0x610 12:32:41 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6_vti0\x00', 0x0, 0x4, 0x42, 0x40, 0x81, 0x5e, @private2, @ipv4={'\x00', '\xff\xff', @remote}, 0x7800, 0x8000, 0x101, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'sit0\x00', r3, 0x2b, 0x5, 0x94, 0x5, 0x50, @loopback, @rand_addr=' \x01\x00', 0x20, 0x8000, 0x6, 0x181e}}) [ 2539.693533] ? netlink_sendskb+0xd0/0xd0 [ 2539.697590] ? __check_object_size+0x179/0x230 [ 2539.702179] netlink_sendmsg+0x648/0xbc0 [ 2539.706236] ? nlmsg_notify+0x1b0/0x1b0 [ 2539.710212] ? kernel_recvmsg+0x210/0x210 [ 2539.714359] ? security_socket_sendmsg+0x83/0xb0 [ 2539.719112] ? nlmsg_notify+0x1b0/0x1b0 [ 2539.723083] sock_sendmsg+0xb5/0x100 [ 2539.726804] ___sys_sendmsg+0x6c8/0x800 [ 2539.730773] ? get_pid_task+0x91/0x130 [ 2539.734653] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2539.739412] ? lock_downgrade+0x740/0x740 [ 2539.743561] ? __fget+0x23e/0x3e0 12:32:41 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6_vti0\x00', 0x0, 0x4, 0x42, 0x40, 0x81, 0x5e, @private2, @ipv4={'\x00', '\xff\xff', @remote}, 0x7800, 0x8000, 0x101, 0x1}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'sit0\x00', r3, 0x2b, 0x5, 0x94, 0x5, 0x50, @loopback, @rand_addr=' \x01\x00', 0x20, 0x8000, 0x6, 0x181e}}) socket$inet6_udp(0xa, 0x2, 0x0) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6_vti0\x00', 0x0, 0x4, 0x42, 0x40, 0x81, 0x5e, @private2, @ipv4={'\x00', '\xff\xff', @remote}, 0x7800, 0x8000, 0x101, 0x1}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'sit0\x00', r3, 0x2b, 0x5, 0x94, 0x5, 0x50, @loopback, @rand_addr=' \x01\x00', 0x20, 0x8000, 0x6, 0x181e}}) (async) 12:32:41 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) (async) r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000140)={'ip6_vti0\x00', 0x0, 0x4, 0x42, 0x40, 0x81, 0x5e, @private2, @ipv4={'\x00', '\xff\xff', @remote}, 0x7800, 0x8000, 0x101, 0x1}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r2, 0x89f8, &(0x7f0000000200)={'sit0\x00', &(0x7f0000000080)={'ip6gre0\x00', r3, 0x0, 0x0, 0x0, 0x0, 0x0, @private1, @empty}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000080)={'sit0\x00', &(0x7f0000000000)={'sit0\x00', r3, 0x2b, 0x5, 0x94, 0x5, 0x50, @loopback, @rand_addr=' \x01\x00', 0x20, 0x8000, 0x6, 0x181e}}) [ 2539.747013] ? lock_acquire+0x170/0x3f0 [ 2539.750981] ? lock_downgrade+0x740/0x740 [ 2539.755133] ? __fget+0x265/0x3e0 [ 2539.758589] ? __fdget+0x19b/0x1f0 [ 2539.762122] ? sockfd_lookup_light+0xb2/0x160 [ 2539.766614] __sys_sendmsg+0xa3/0x120 [ 2539.770417] ? SyS_shutdown+0x160/0x160 [ 2539.774395] ? wait_for_completion_io+0x10/0x10 [ 2539.779065] ? SyS_read+0x210/0x210 [ 2539.782690] ? __do_page_fault+0x159/0xad0 [ 2539.786926] SyS_sendmsg+0x27/0x40 [ 2539.790457] ? __sys_sendmsg+0x120/0x120 [ 2539.794511] do_syscall_64+0x1d5/0x640 [ 2539.798412] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2539.803593] RIP: 0033:0x7fc05f6a20e9 [ 2539.807378] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2539.815085] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2539.822345] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2539.829604] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2539.836893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c0000000000"]}) 12:32:41 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) [ 2539.844166] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:41 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 42) 12:32:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) pkey_alloc(0x0, 0x1) r1 = pkey_alloc(0x0, 0x1) pkey_free(r1) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYRESOCT=r1], 0x20}}, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x42}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}]}, 0x34}}, 0x4004) [ 2539.890561] nbd: failed to add new device 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X']}) 12:32:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async, rerun: 32) pkey_alloc(0x0, 0x1) (async, rerun: 32) r1 = pkey_alloc(0x0, 0x1) pkey_free(r1) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:41 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) (async) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) (async) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) [ 2539.971317] FAULT_INJECTION: forcing a failure. [ 2539.971317] name failslab, interval 1, probability 0, space 0, times 0 [ 2540.030767] CPU: 1 PID: 3742 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2540.038580] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2540.047930] Call Trace: [ 2540.050524] dump_stack+0x1b2/0x281 [ 2540.054151] should_fail.cold+0x10a/0x149 [ 2540.058300] should_failslab+0xd6/0x130 [ 2540.062284] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2540.067474] blk_mq_init_tags+0x5e/0x280 [ 2540.071535] blk_mq_alloc_rq_map+0x90/0x220 [ 2540.075855] blk_mq_sched_alloc_tags+0xaa/0x240 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X']}) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x67, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X']}) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x38, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'ipvlan0\x00'}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xc2c}]}, 0x38}, 0x1, 0x0, 0x0, 0x40840}, 0x84) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="65727370616e30000200000000f8ff00", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2540.080526] blk_mq_init_sched+0x18d/0x4a0 [ 2540.084754] ? _raw_spin_unlock+0x29/0x40 [ 2540.088907] elevator_init+0x2ee/0x410 [ 2540.092791] blk_mq_sched_init+0x28/0x40 [ 2540.096852] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2540.101960] blk_mq_init_queue+0x5a/0x90 [ 2540.106027] nbd_dev_add+0x2c6/0x800 [ 2540.109741] ? nbd_send_cmd+0x11f0/0x11f0 [ 2540.113887] ? ns_capable_common+0x127/0x150 [ 2540.118292] nbd_genl_connect+0x3a4/0x1400 [ 2540.122521] ? lock_acquire+0x170/0x3f0 [ 2540.126492] ? nbd_xmit_timeout+0x500/0x500 [ 2540.130811] ? validate_nla+0x192/0x5e0 [ 2540.134792] ? nla_parse+0x157/0x1f0 [ 2540.138590] genl_family_rcv_msg+0x572/0xb20 [ 2540.143091] ? genl_rcv+0x40/0x40 [ 2540.146545] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2540.152086] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2540.157184] ? trace_hardirqs_on+0x10/0x10 [ 2540.161420] genl_rcv_msg+0xaf/0x140 [ 2540.165144] netlink_rcv_skb+0x125/0x390 [ 2540.169200] ? genl_family_rcv_msg+0xb20/0xb20 [ 2540.173777] ? netlink_ack+0x9a0/0x9a0 [ 2540.177661] ? lock_acquire+0x170/0x3f0 [ 2540.181634] genl_rcv+0x24/0x40 [ 2540.184908] netlink_unicast+0x437/0x610 [ 2540.188964] ? netlink_sendskb+0xd0/0xd0 [ 2540.193021] ? __check_object_size+0x179/0x230 [ 2540.197599] netlink_sendmsg+0x648/0xbc0 [ 2540.201659] ? nlmsg_notify+0x1b0/0x1b0 [ 2540.205624] ? kernel_recvmsg+0x210/0x210 [ 2540.209766] ? security_socket_sendmsg+0x83/0xb0 [ 2540.214511] ? nlmsg_notify+0x1b0/0x1b0 [ 2540.218487] sock_sendmsg+0xb5/0x100 [ 2540.222200] ___sys_sendmsg+0x6c8/0x800 [ 2540.226170] ? get_pid_task+0x91/0x130 [ 2540.230051] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2540.234806] ? lock_downgrade+0x740/0x740 [ 2540.238948] ? __fget+0x23e/0x3e0 [ 2540.242407] ? lock_acquire+0x170/0x3f0 [ 2540.246379] ? lock_downgrade+0x740/0x740 [ 2540.250520] ? __fget+0x265/0x3e0 [ 2540.253972] ? __fdget+0x19b/0x1f0 [ 2540.257507] ? sockfd_lookup_light+0xb2/0x160 [ 2540.262002] __sys_sendmsg+0xa3/0x120 [ 2540.265807] ? SyS_shutdown+0x160/0x160 [ 2540.269765] ? wait_for_completion_io+0x10/0x10 [ 2540.274420] ? SyS_read+0x210/0x210 [ 2540.278026] ? __do_page_fault+0x159/0xad0 [ 2540.282338] SyS_sendmsg+0x27/0x40 [ 2540.285859] ? __sys_sendmsg+0x120/0x120 [ 2540.289898] do_syscall_64+0x1d5/0x640 [ 2540.293765] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2540.298933] RIP: 0033:0x7fc05f6a20e9 [ 2540.302618] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2540.310312] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2540.317650] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2540.324900] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:41 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 43) 12:32:41 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f30c00"]}) 12:32:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) pkey_alloc(0x0, 0x1) (async) r1 = pkey_alloc(0x0, 0x1) pkey_free(r1) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:41 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYRESOCT=r1], 0x20}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x42}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}]}, 0x34}}, 0x4004) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r0) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r1, @ANYRES16=r1, @ANYRESOCT=r1], 0x20}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x34, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e24}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x42}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x7}]}, 0x34}}, 0x4004) (async) 12:32:41 executing program 5: r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000080), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), 0xffffffffffffffff) (async) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r0, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x7}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) (async) 12:32:41 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x38, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'ipvlan0\x00'}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xc2c}]}, 0x38}, 0x1, 0x0, 0x0, 0x40840}, 0x84) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="65727370616e30000200000000f8ff00", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) [ 2540.332156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2540.339412] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2540.347919] nbd: failed to add new device 12:32:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) [ 2540.454280] FAULT_INJECTION: forcing a failure. [ 2540.454280] name failslab, interval 1, probability 0, space 0, times 0 [ 2540.473353] CPU: 1 PID: 3813 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2540.482134] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2540.491477] Call Trace: [ 2540.494063] dump_stack+0x1b2/0x281 [ 2540.497696] should_fail.cold+0x10a/0x149 [ 2540.501846] should_failslab+0xd6/0x130 [ 2540.505832] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2540.510933] blk_mq_init_tags+0x5e/0x280 [ 2540.514995] blk_mq_alloc_rq_map+0x90/0x220 [ 2540.519325] blk_mq_sched_alloc_tags+0xaa/0x240 [ 2540.524004] blk_mq_init_sched+0x18d/0x4a0 [ 2540.528232] ? _raw_spin_unlock+0x29/0x40 [ 2540.532378] elevator_init+0x2ee/0x410 [ 2540.536259] blk_mq_sched_init+0x28/0x40 [ 2540.540333] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2540.545440] blk_mq_init_queue+0x5a/0x90 [ 2540.549494] nbd_dev_add+0x2c6/0x800 [ 2540.553213] ? nbd_send_cmd+0x11f0/0x11f0 [ 2540.557364] ? ns_capable_common+0x127/0x150 [ 2540.561858] nbd_genl_connect+0x3a4/0x1400 [ 2540.566088] ? lock_acquire+0x170/0x3f0 [ 2540.570045] ? nbd_xmit_timeout+0x500/0x500 [ 2540.574354] ? validate_nla+0x192/0x5e0 [ 2540.578314] ? nla_parse+0x157/0x1f0 [ 2540.582135] genl_family_rcv_msg+0x572/0xb20 [ 2540.586546] ? genl_rcv+0x40/0x40 [ 2540.589989] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2540.595551] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2540.600645] ? trace_hardirqs_on+0x10/0x10 [ 2540.604862] genl_rcv_msg+0xaf/0x140 [ 2540.608565] netlink_rcv_skb+0x125/0x390 [ 2540.612609] ? genl_family_rcv_msg+0xb20/0xb20 [ 2540.617177] ? netlink_ack+0x9a0/0x9a0 [ 2540.621056] ? lock_acquire+0x170/0x3f0 [ 2540.625144] genl_rcv+0x24/0x40 [ 2540.628411] netlink_unicast+0x437/0x610 [ 2540.632449] ? netlink_sendskb+0xd0/0xd0 [ 2540.636499] ? __check_object_size+0x179/0x230 [ 2540.641075] netlink_sendmsg+0x648/0xbc0 [ 2540.645123] ? nlmsg_notify+0x1b0/0x1b0 [ 2540.649080] ? kernel_recvmsg+0x210/0x210 [ 2540.653209] ? security_socket_sendmsg+0x83/0xb0 [ 2540.657946] ? nlmsg_notify+0x1b0/0x1b0 [ 2540.661904] sock_sendmsg+0xb5/0x100 [ 2540.665604] ___sys_sendmsg+0x6c8/0x800 [ 2540.669558] ? get_pid_task+0x91/0x130 [ 2540.673436] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2540.678188] ? lock_downgrade+0x740/0x740 [ 2540.682333] ? __fget+0x23e/0x3e0 [ 2540.685772] ? lock_acquire+0x170/0x3f0 [ 2540.689721] ? lock_downgrade+0x740/0x740 [ 2540.693850] ? __fget+0x265/0x3e0 [ 2540.697294] ? __fdget+0x19b/0x1f0 [ 2540.700823] ? sockfd_lookup_light+0xb2/0x160 [ 2540.705297] __sys_sendmsg+0xa3/0x120 [ 2540.709076] ? SyS_shutdown+0x160/0x160 [ 2540.713116] ? wait_for_completion_io+0x10/0x10 [ 2540.717784] ? SyS_read+0x210/0x210 [ 2540.721400] ? __do_page_fault+0x159/0xad0 [ 2540.725700] SyS_sendmsg+0x27/0x40 [ 2540.729222] ? __sys_sendmsg+0x120/0x120 [ 2540.733267] do_syscall_64+0x1d5/0x640 [ 2540.737153] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2540.742326] RIP: 0033:0x7fc05f6a20e9 [ 2540.746017] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:42 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="11d4f3af52b822ac13a41c39503e008e", @ANYRES16=r2, @ANYBLOB="200026bd7000ffdbdf25030000000500040000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4090) 12:32:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x38, r2, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@L2TP_ATTR_IFNAME={0x14, 0x8, 'ipvlan0\x00'}, @L2TP_ATTR_PEER_SESSION_ID={0x8}, @L2TP_ATTR_MTU={0x6, 0x1c, 0xc2c}]}, 0x38}, 0x1, 0x0, 0x0, 0x40840}, 0x84) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="65727370616e30000200000000f8ff00", @ANYRES32=0x0, @ANYBLOB="000000010000000000000000450000140000000000009078e0000001ac1414aa"]}) 12:32:42 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 44) 12:32:42 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="5a7886d56fb7dc3e4461725da6b1a8f216b442b828cd7b360a08c784054e07111015866aa9be380902e9b6cb7e814331e99f95e9522e1f6f862bee6ef2f41994f5f756d8ee6fca06716ef74392bf05e63f2a61e4c3e338eb24e8ec79cf14f1b0af391b23f0b09c32d54a0b524b30445aaa5c75a441b8fa4535172fb8e73f9b7f1d9762df35620e5583fb634678e67101d59a36ffa93ebbb7459236c37a4d412d088b51b212e9eab0804756af78a00071f71243dae2b346c96f6cde46182ac41bd0d9104914"]}) [ 2540.753819] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2540.761063] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2540.768312] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2540.775576] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2540.782828] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2540.798605] nbd: failed to add new device 12:32:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:42 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 1) 12:32:42 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="11d4f3af52b822ac13a41c39503e008e", @ANYRES16=r2, @ANYBLOB="200026bd7000ffdbdf25030000000500040000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4090) 12:32:42 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="5a7886d56fb7dc3e4461725da6b1a8f216b442b828cd7b360a08c784054e07111015866aa9be380902e9b6cb7e814331e99f95e9522e1f6f862bee6ef2f41994f5f756d8ee6fca06716ef74392bf05e63f2a61e4c3e338eb24e8ec79cf14f1b0af391b23f0b09c32d54a0b524b30445aaa5c75a441b8fa4535172fb8e73f9b7f1d9762df35620e5583fb634678e67101d59a36ffa93ebbb7459236c37a4d412d088b51b212e9eab0804756af78a00071f71243dae2b346c96f6cde46182ac41bd0d9104914"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="5a7886d56fb7dc3e4461725da6b1a8f216b442b828cd7b360a08c784054e07111015866aa9be380902e9b6cb7e814331e99f95e9522e1f6f862bee6ef2f41994f5f756d8ee6fca06716ef74392bf05e63f2a61e4c3e338eb24e8ec79cf14f1b0af391b23f0b09c32d54a0b524b30445aaa5c75a441b8fa4535172fb8e73f9b7f1d9762df35620e5583fb634678e67101d59a36ffa93ebbb7459236c37a4d412d088b51b212e9eab0804756af78a00071f71243dae2b346c96f6cde46182ac41bd0d9104914"]}) (async) [ 2540.898582] FAULT_INJECTION: forcing a failure. [ 2540.898582] name failslab, interval 1, probability 0, space 0, times 0 12:32:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="20082abd7000fedbdf25040000000c000f000000000000180000080011000100000006001d00080000000500050001000000050004000000000008001700", @ANYRES32, @ANYBLOB="06000e003f0000000500140003000000"], 0x58}, 0x1, 0x0, 0x0, 0x2}, 0x40) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40440c4}, 0x20000040) [ 2540.956436] CPU: 1 PID: 3869 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2540.964246] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2540.973593] Call Trace: [ 2540.976178] dump_stack+0x1b2/0x281 [ 2540.979808] should_fail.cold+0x10a/0x149 [ 2540.983955] should_failslab+0xd6/0x130 [ 2540.987927] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2540.993036] blk_mq_init_tags+0x5e/0x280 [ 2540.997094] blk_mq_alloc_rq_map+0x90/0x220 [ 2541.001415] blk_mq_sched_alloc_tags+0xaa/0x240 12:32:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="20082abd7000fedbdf25040000000c000f000000000000180000080011000100000006001d00080000000500050001000000050004000000000008001700", @ANYRES32, @ANYBLOB="06000e003f0000000500140003000000"], 0x58}, 0x1, 0x0, 0x0, 0x2}, 0x40) (async) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40440c4}, 0x20000040) [ 2541.006095] blk_mq_init_sched+0x18d/0x4a0 [ 2541.010323] ? _raw_spin_unlock+0x29/0x40 [ 2541.014471] elevator_init+0x2ee/0x410 [ 2541.018356] blk_mq_sched_init+0x28/0x40 [ 2541.022420] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2541.027522] blk_mq_init_queue+0x5a/0x90 [ 2541.031579] nbd_dev_add+0x2c6/0x800 [ 2541.035289] ? nbd_send_cmd+0x11f0/0x11f0 [ 2541.039435] ? ns_capable_common+0x127/0x150 [ 2541.043839] nbd_genl_connect+0x3a4/0x1400 [ 2541.048064] ? lock_acquire+0x170/0x3f0 [ 2541.052035] ? nbd_xmit_timeout+0x500/0x500 12:32:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r0, &(0x7f0000000280)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="20082abd7000fedbdf25040000000c000f000000000000180000080011000100000006001d00080000000500050001000000050004000000000008001700", @ANYRES32, @ANYBLOB="06000e003f0000000500140003000000"], 0x58}, 0x1, 0x0, 0x0, 0x2}, 0x40) sendmsg$BATADV_CMD_GET_VLAN(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x3c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x1}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40440c4}, 0x20000040) [ 2541.056350] ? validate_nla+0x192/0x5e0 [ 2541.060319] ? nla_parse+0x157/0x1f0 [ 2541.064030] genl_family_rcv_msg+0x572/0xb20 [ 2541.068436] ? genl_rcv+0x40/0x40 [ 2541.071975] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2541.077418] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2541.082514] ? trace_hardirqs_on+0x10/0x10 [ 2541.086757] genl_rcv_msg+0xaf/0x140 [ 2541.090467] netlink_rcv_skb+0x125/0x390 [ 2541.094523] ? genl_family_rcv_msg+0xb20/0xb20 [ 2541.099098] ? netlink_ack+0x9a0/0x9a0 [ 2541.102981] ? lock_acquire+0x170/0x3f0 12:32:42 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x2f, 0x8, 0x8a, 0x10001, 0xc, @ipv4={'\x00', '\xff\xff', @local}, @mcast2, 0x10, 0x80, 0x7f, 0x225}}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000200)) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000040)={0x0, 0x7aa}) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000003c0)={0x800, 0x8c5, &(0x7f0000000240)="e4f1af12ddca59ca28a5bdb3c252e0b9740461ab1df73bf8af20d6ec05cd7c29561cd37b8a9691e8aa3f1157113001c7ea44de6f8f82bd9890a55063688d3a4ed53f42367c4c74ecfbf46cabae54a7abfd11f549ecdd17cedf78279f238cd734ec9efa655b7241f207908bf13a0deb56a35710c278b16556733a907a732311e5c17ba079ee0ebc5b7dff", &(0x7f0000000300)="7126d340f754d9637a0587e91a7f46167bf4d3bdfb783945d8ebe4b904dbb0437d7326c9692a0fc1e2f9c93aa693995365ff231eb04d15f42621205cf1be1be04fcc14bfa8fa8f", 0x8a, 0x47}) [ 2541.106953] genl_rcv+0x24/0x40 [ 2541.110229] netlink_unicast+0x437/0x610 [ 2541.114286] ? netlink_sendskb+0xd0/0xd0 [ 2541.118341] ? __check_object_size+0x179/0x230 [ 2541.122918] netlink_sendmsg+0x648/0xbc0 [ 2541.126976] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.130938] ? kernel_recvmsg+0x210/0x210 [ 2541.135088] ? security_socket_sendmsg+0x83/0xb0 [ 2541.139836] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.143805] sock_sendmsg+0xb5/0x100 [ 2541.147520] ___sys_sendmsg+0x6c8/0x800 [ 2541.151576] ? get_pid_task+0x91/0x130 [ 2541.155458] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2541.160210] ? lock_downgrade+0x740/0x740 [ 2541.164354] ? __fget+0x23e/0x3e0 [ 2541.167802] ? lock_acquire+0x170/0x3f0 [ 2541.171773] ? lock_downgrade+0x740/0x740 [ 2541.175993] ? __fget+0x265/0x3e0 [ 2541.179425] ? __fdget+0x19b/0x1f0 [ 2541.182944] ? sockfd_lookup_light+0xb2/0x160 [ 2541.187424] __sys_sendmsg+0xa3/0x120 [ 2541.191211] ? SyS_shutdown+0x160/0x160 [ 2541.195169] ? wait_for_completion_io+0x10/0x10 [ 2541.199829] ? SyS_read+0x210/0x210 [ 2541.203436] ? __do_page_fault+0x159/0xad0 [ 2541.207653] SyS_sendmsg+0x27/0x40 [ 2541.211176] ? __sys_sendmsg+0x120/0x120 [ 2541.215214] do_syscall_64+0x1d5/0x640 [ 2541.219088] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2541.224259] RIP: 0033:0x7fc05f6a20e9 [ 2541.227949] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2541.235643] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2541.242887] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2541.250137] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:42 executing program 5: socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="5a7886d56fb7dc3e4461725da6b1a8f216b442b828cd7b360a08c784054e07111015866aa9be380902e9b6cb7e814331e99f95e9522e1f6f862bee6ef2f41994f5f756d8ee6fca06716ef74392bf05e63f2a61e4c3e338eb24e8ec79cf14f1b0af391b23f0b09c32d54a0b524b30445aaa5c75a441b8fa4535172fb8e73f9b7f1d9762df35620e5583fb634678e67101d59a36ffa93ebbb7459236c37a4d412d088b51b212e9eab0804756af78a00071f71243dae2b346c96f6cde46182ac41bd0d9104914"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="5a7886d56fb7dc3e4461725da6b1a8f216b442b828cd7b360a08c784054e07111015866aa9be380902e9b6cb7e814331e99f95e9522e1f6f862bee6ef2f41994f5f756d8ee6fca06716ef74392bf05e63f2a61e4c3e338eb24e8ec79cf14f1b0af391b23f0b09c32d54a0b524b30445aaa5c75a441b8fa4535172fb8e73f9b7f1d9762df35620e5583fb634678e67101d59a36ffa93ebbb7459236c37a4d412d088b51b212e9eab0804756af78a00071f71243dae2b346c96f6cde46182ac41bd0d9104914"]}) (async) 12:32:42 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9f3"]}) [ 2541.257388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2541.264640] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2541.283017] nbd: failed to add new device [ 2541.287726] FAULT_INJECTION: forcing a failure. [ 2541.287726] name failslab, interval 1, probability 0, space 0, times 0 [ 2541.299510] CPU: 1 PID: 3915 Comm: syz-executor.3 Not tainted 4.14.277-syzkaller #0 [ 2541.307302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2541.321248] Call Trace: [ 2541.323832] dump_stack+0x1b2/0x281 [ 2541.327458] should_fail.cold+0x10a/0x149 [ 2541.331606] should_failslab+0xd6/0x130 [ 2541.335581] kmem_cache_alloc_node+0x263/0x410 [ 2541.340159] __alloc_skb+0x5c/0x510 [ 2541.343784] netlink_sendmsg+0x91e/0xbc0 [ 2541.347843] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.351821] ? kernel_recvmsg+0x210/0x210 [ 2541.355964] ? security_socket_sendmsg+0x83/0xb0 [ 2541.360713] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.364678] sock_sendmsg+0xb5/0x100 [ 2541.368385] ___sys_sendmsg+0x6c8/0x800 [ 2541.372351] ? get_pid_task+0x91/0x130 [ 2541.376239] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2541.380997] ? lock_downgrade+0x740/0x740 [ 2541.385155] ? __fget+0x23e/0x3e0 [ 2541.388604] ? lock_acquire+0x170/0x3f0 [ 2541.392570] ? lock_downgrade+0x740/0x740 [ 2541.396724] ? __fget+0x265/0x3e0 [ 2541.400180] ? __fdget+0x19b/0x1f0 [ 2541.403725] ? sockfd_lookup_light+0xb2/0x160 [ 2541.408222] __sys_sendmsg+0xa3/0x120 [ 2541.412019] ? SyS_shutdown+0x160/0x160 [ 2541.415988] ? wait_for_completion_io+0x10/0x10 [ 2541.420659] ? SyS_read+0x210/0x210 [ 2541.424280] ? __do_page_fault+0x159/0xad0 [ 2541.428508] SyS_sendmsg+0x27/0x40 [ 2541.432051] ? __sys_sendmsg+0x120/0x120 [ 2541.436117] do_syscall_64+0x1d5/0x640 [ 2541.440002] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2541.445186] RIP: 0033:0x7feea38d20e9 [ 2541.448891] RSP: 002b:00007feea2226168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 12:32:43 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 45) 12:32:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x2f, 0x8, 0x8a, 0x10001, 0xc, @ipv4={'\x00', '\xff\xff', @local}, @mcast2, 0x10, 0x80, 0x7f, 0x225}}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000200)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000040)={0x0, 0x7aa}) (async) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000003c0)={0x800, 0x8c5, &(0x7f0000000240)="e4f1af12ddca59ca28a5bdb3c252e0b9740461ab1df73bf8af20d6ec05cd7c29561cd37b8a9691e8aa3f1157113001c7ea44de6f8f82bd9890a55063688d3a4ed53f42367c4c74ecfbf46cabae54a7abfd11f549ecdd17cedf78279f238cd734ec9efa655b7241f207908bf13a0deb56a35710c278b16556733a907a732311e5c17ba079ee0ebc5b7dff", &(0x7f0000000300)="7126d340f754d9637a0587e91a7f46167bf4d3bdfb783945d8ebe4b904dbb0437d7326c9692a0fc1e2f9c93aa693995365ff231eb04d15f42621205cf1be1be04fcc14bfa8fa8f", 0x8a, 0x47}) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x200, 0x64c1) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x8001) [ 2541.456591] RAX: ffffffffffffffda RBX: 00007feea39e5030 RCX: 00007feea38d20e9 [ 2541.463852] RDX: 0000000020000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 2541.471114] RBP: 00007feea22261d0 R08: 0000000000000000 R09: 0000000000000000 [ 2541.478373] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2541.485639] R13: 00007ffdd2195d4f R14: 00007feea2226300 R15: 0000000000022000 12:32:43 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 2) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="11d4f3af52b822ac13a41c39503e008e", @ANYRES16=r2, @ANYBLOB="200026bd7000ffdbdf25030000000500040000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4090) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r2, 0x1}, 0x14}}, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="11d4f3af52b822ac13a41c39503e008e", @ANYRES16=r2, @ANYBLOB="200026bd7000ffdbdf25030000000500040000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4090) (async) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x200, 0x64c1) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x8001) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) (async) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x200, 0x64c1) (async) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x8001) (async) [ 2541.552107] FAULT_INJECTION: forcing a failure. [ 2541.552107] name failslab, interval 1, probability 0, space 0, times 0 [ 2541.585033] CPU: 1 PID: 3938 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2541.592856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2541.602202] Call Trace: [ 2541.604789] dump_stack+0x1b2/0x281 [ 2541.608421] should_fail.cold+0x10a/0x149 [ 2541.612569] should_failslab+0xd6/0x130 [ 2541.616541] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2541.621641] sbitmap_queue_init_node+0x27f/0x5d0 [ 2541.626397] ? kmem_cache_alloc_node_trace+0x383/0x400 [ 2541.631675] blk_mq_init_tags+0xf4/0x280 [ 2541.635742] blk_mq_alloc_rq_map+0x90/0x220 [ 2541.640064] blk_mq_sched_alloc_tags+0xaa/0x240 [ 2541.644736] blk_mq_init_sched+0x18d/0x4a0 [ 2541.648963] ? _raw_spin_unlock+0x29/0x40 [ 2541.653106] elevator_init+0x2ee/0x410 [ 2541.656989] blk_mq_sched_init+0x28/0x40 [ 2541.661047] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2541.666150] blk_mq_init_queue+0x5a/0x90 [ 2541.670206] nbd_dev_add+0x2c6/0x800 [ 2541.673918] ? nbd_send_cmd+0x11f0/0x11f0 [ 2541.678061] ? ns_capable_common+0x127/0x150 [ 2541.682464] nbd_genl_connect+0x3a4/0x1400 [ 2541.686698] ? lock_acquire+0x170/0x3f0 [ 2541.690665] ? nbd_xmit_timeout+0x500/0x500 [ 2541.694984] ? validate_nla+0x192/0x5e0 [ 2541.698950] ? nla_parse+0x157/0x1f0 [ 2541.700500] FAULT_INJECTION: forcing a failure. [ 2541.700500] name failslab, interval 1, probability 0, space 0, times 0 [ 2541.702660] genl_family_rcv_msg+0x572/0xb20 [ 2541.702720] ? genl_rcv+0x40/0x40 [ 2541.721704] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2541.727149] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2541.732243] ? trace_hardirqs_on+0x10/0x10 [ 2541.736469] genl_rcv_msg+0xaf/0x140 [ 2541.740163] netlink_rcv_skb+0x125/0x390 [ 2541.744205] ? genl_family_rcv_msg+0xb20/0xb20 [ 2541.748768] ? netlink_ack+0x9a0/0x9a0 [ 2541.752635] ? lock_acquire+0x170/0x3f0 [ 2541.756594] genl_rcv+0x24/0x40 [ 2541.759850] netlink_unicast+0x437/0x610 [ 2541.763897] ? netlink_sendskb+0xd0/0xd0 [ 2541.767947] ? __check_object_size+0x179/0x230 [ 2541.772515] netlink_sendmsg+0x648/0xbc0 [ 2541.776556] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.780508] ? kernel_recvmsg+0x210/0x210 [ 2541.784643] ? security_socket_sendmsg+0x83/0xb0 [ 2541.789380] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.793337] sock_sendmsg+0xb5/0x100 [ 2541.797032] ___sys_sendmsg+0x6c8/0x800 [ 2541.800988] ? get_pid_task+0x91/0x130 [ 2541.804861] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2541.809600] ? lock_downgrade+0x740/0x740 [ 2541.813729] ? __fget+0x23e/0x3e0 [ 2541.817165] ? lock_acquire+0x170/0x3f0 [ 2541.821119] ? lock_downgrade+0x740/0x740 [ 2541.825252] ? __fget+0x265/0x3e0 [ 2541.828697] ? __fdget+0x19b/0x1f0 [ 2541.832227] ? sockfd_lookup_light+0xb2/0x160 [ 2541.836712] __sys_sendmsg+0xa3/0x120 [ 2541.840498] ? SyS_shutdown+0x160/0x160 [ 2541.844455] ? wait_for_completion_io+0x10/0x10 [ 2541.849198] ? SyS_read+0x210/0x210 [ 2541.852803] ? __do_page_fault+0x159/0xad0 [ 2541.857018] SyS_sendmsg+0x27/0x40 [ 2541.860536] ? __sys_sendmsg+0x120/0x120 [ 2541.864578] do_syscall_64+0x1d5/0x640 [ 2541.868455] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2541.873630] RIP: 0033:0x7fc05f6a20e9 [ 2541.877322] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2541.885017] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2541.892272] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2541.899528] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2541.906785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2541.914041] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2541.921305] CPU: 0 PID: 3950 Comm: syz-executor.3 Not tainted 4.14.277-syzkaller #0 [ 2541.929096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2541.938439] Call Trace: [ 2541.941021] dump_stack+0x1b2/0x281 [ 2541.944649] should_fail.cold+0x10a/0x149 [ 2541.948794] should_failslab+0xd6/0x130 [ 2541.952767] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2541.957873] __kmalloc_node_track_caller+0x38/0x70 [ 2541.962795] __alloc_skb+0x96/0x510 [ 2541.966417] netlink_sendmsg+0x91e/0xbc0 [ 2541.970477] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.974445] ? kernel_recvmsg+0x210/0x210 [ 2541.978586] ? security_socket_sendmsg+0x83/0xb0 [ 2541.983334] ? nlmsg_notify+0x1b0/0x1b0 [ 2541.987303] sock_sendmsg+0xb5/0x100 [ 2541.991014] ___sys_sendmsg+0x6c8/0x800 [ 2541.994982] ? get_pid_task+0x91/0x130 [ 2541.998862] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.003618] ? lock_downgrade+0x740/0x740 [ 2542.007774] ? __fget+0x23e/0x3e0 [ 2542.011225] ? lock_acquire+0x170/0x3f0 [ 2542.015197] ? lock_downgrade+0x740/0x740 [ 2542.019340] ? __fget+0x265/0x3e0 [ 2542.022796] ? __fdget+0x19b/0x1f0 [ 2542.026334] ? sockfd_lookup_light+0xb2/0x160 [ 2542.030826] __sys_sendmsg+0xa3/0x120 [ 2542.034619] ? SyS_shutdown+0x160/0x160 [ 2542.038593] ? wait_for_completion_io+0x10/0x10 [ 2542.043263] ? SyS_read+0x210/0x210 [ 2542.046881] ? __do_page_fault+0x159/0xad0 [ 2542.051112] SyS_sendmsg+0x27/0x40 [ 2542.054643] ? __sys_sendmsg+0x120/0x120 [ 2542.058694] do_syscall_64+0x1d5/0x640 [ 2542.062584] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.067760] RIP: 0033:0x7feea38d20e9 [ 2542.071462] RSP: 002b:00007feea2247168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.079163] RAX: ffffffffffffffda RBX: 00007feea39e4f60 RCX: 00007feea38d20e9 [ 2542.086429] RDX: 0000000020000004 RSI: 0000000020000200 RDI: 0000000000000004 [ 2542.093729] RBP: 00007feea22471d0 R08: 0000000000000000 R09: 0000000000000000 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcfbf5"]}) (async) syz_open_dev$sndpcmp(&(0x7f0000000040), 0x200, 0x64c1) (async, rerun: 64) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x8001) (rerun: 64) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b1c8af4bcfbf5"]}) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b1c8af4bcfbf5"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b1c8af4bcfbf5"]}) (async) [ 2542.100989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.108255] R13: 00007ffdd2195d4f R14: 00007feea2247300 R15: 0000000000022000 [ 2542.115747] nbd: failed to add new device 12:32:43 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 46) 12:32:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x2, 0x80, 0x1f, 0x7, 0x1, 0x40, 0x0, 0x8000000000000001, 0x40040, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0xb22, 0x4, @perf_bp={&(0x7f0000000180), 0x8}, 0x8008, 0xf89, 0xde2e, 0x4, 0x1f, 0x40, 0x8, 0x0, 0x800, 0x0, 0xfffffffffffffffb}, r2, 0x9, r3, 0x8) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x3ff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000044) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000180)={'ip6tnl0\x00', r2, 0x2f, 0x8, 0x8a, 0x10001, 0xc, @ipv4={'\x00', '\xff\xff', @local}, @mcast2, 0x10, 0x80, 0x7f, 0x225}}) (async) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000200)) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), 0xffffffffffffffff) (async) ioctl$VHOST_SET_VRING_NUM(0xffffffffffffffff, 0x4008af10, &(0x7f0000000040)={0x0, 0x7aa}) (async, rerun: 32) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000003c0)={0x800, 0x8c5, &(0x7f0000000240)="e4f1af12ddca59ca28a5bdb3c252e0b9740461ab1df73bf8af20d6ec05cd7c29561cd37b8a9691e8aa3f1157113001c7ea44de6f8f82bd9890a55063688d3a4ed53f42367c4c74ecfbf46cabae54a7abfd11f549ecdd17cedf78279f238cd734ec9efa655b7241f207908bf13a0deb56a35710c278b16556733a907a732311e5c17ba079ee0ebc5b7dff", &(0x7f0000000300)="7126d340f754d9637a0587e91a7f46167bf4d3bdfb783945d8ebe4b904dbb0437d7326c9692a0fc1e2f9c93aa693995365ff231eb04d15f42621205cf1be1be04fcc14bfa8fa8f", 0x8a, 0x47}) (rerun: 32) 12:32:43 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 3) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b1c8af4bcfbf5"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b1c8af4bcfbf5"]}) (async) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) [ 2542.236896] FAULT_INJECTION: forcing a failure. [ 2542.236896] name failslab, interval 1, probability 0, space 0, times 0 [ 2542.258467] FAULT_INJECTION: forcing a failure. [ 2542.258467] name failslab, interval 1, probability 0, space 0, times 0 [ 2542.286731] CPU: 0 PID: 4003 Comm: syz-executor.3 Not tainted 4.14.277-syzkaller #0 [ 2542.294544] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2542.303894] Call Trace: [ 2542.306485] dump_stack+0x1b2/0x281 [ 2542.310117] should_fail.cold+0x10a/0x149 [ 2542.314270] should_failslab+0xd6/0x130 [ 2542.318246] kmem_cache_alloc+0x40/0x3c0 [ 2542.322308] skb_clone+0x126/0x9a0 [ 2542.325854] netlink_deliver_tap+0x67e/0x860 [ 2542.330272] netlink_unicast+0x485/0x610 12:32:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async, rerun: 64) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) (rerun: 64) perf_event_open$cgroup(&(0x7f00000001c0)={0x2, 0x80, 0x1f, 0x7, 0x1, 0x40, 0x0, 0x8000000000000001, 0x40040, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0xb22, 0x4, @perf_bp={&(0x7f0000000180), 0x8}, 0x8008, 0xf89, 0xde2e, 0x4, 0x1f, 0x40, 0x8, 0x0, 0x800, 0x0, 0xfffffffffffffffb}, r2, 0x9, r3, 0x8) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x3ff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000044) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:43 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x28}, 0x1, 0x0, 0x0, 0x8}, 0x8060) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r5) 12:32:43 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="40008ed715a74b234b5e215a49a09fb24b188af4bcfbf5c303c75909e61b5dd474c471ad33190c97fd12339ca2f25a431e2e7679877c83ec47ac400713070dae6c3263f39bef7fcaff1f2a60952c929cbf83848b51b9db7eeb19cd60675688d0da4e25133b9f4029b8ab7cce6cf6166fce3ff354ebb515cb5c9338c4975a92402a75b51d75"]}) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) 12:32:43 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB='X,']}) [ 2542.334332] ? netlink_sendskb+0xd0/0xd0 [ 2542.338393] ? __check_object_size+0x179/0x230 [ 2542.342973] netlink_sendmsg+0x648/0xbc0 [ 2542.347033] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.351005] ? kernel_recvmsg+0x210/0x210 [ 2542.355151] ? security_socket_sendmsg+0x83/0xb0 [ 2542.359904] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.364222] sock_sendmsg+0xb5/0x100 [ 2542.364233] ___sys_sendmsg+0x6c8/0x800 [ 2542.364242] ? get_pid_task+0x91/0x130 [ 2542.364252] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.364265] ? lock_downgrade+0x740/0x740 [ 2542.364278] ? __fget+0x23e/0x3e0 [ 2542.364290] ? lock_acquire+0x170/0x3f0 [ 2542.364299] ? lock_downgrade+0x740/0x740 [ 2542.364310] ? __fget+0x265/0x3e0 [ 2542.399685] ? __fdget+0x19b/0x1f0 [ 2542.399698] ? sockfd_lookup_light+0xb2/0x160 [ 2542.407731] __sys_sendmsg+0xa3/0x120 [ 2542.407741] ? SyS_shutdown+0x160/0x160 12:32:44 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 47) 12:32:44 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="582ce9"]}) 12:32:44 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x28}, 0x1, 0x0, 0x0, 0x8}, 0x8060) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r5) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x28}, 0x1, 0x0, 0x0, 0x8}, 0x8060) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r3) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r5) (async) [ 2542.407755] ? wait_for_completion_io+0x10/0x10 [ 2542.407774] ? SyS_read+0x210/0x210 [ 2542.407785] SyS_sendmsg+0x27/0x40 [ 2542.407793] ? __sys_sendmsg+0x120/0x120 12:32:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 4) 12:32:44 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="40008ed715a74b234b5e215a49a09fb24b188af4bcfbf5c303c75909e61b5dd474c471ad33190c97fd12339ca2f25a431e2e7679877c83ec47ac400713070dae6c3263f39bef7fcaff1f2a60952c929cbf83848b51b9db7eeb19cd60675688d0da4e25133b9f4029b8ab7cce6cf6166fce3ff354ebb515cb5c9338c4975a92402a75b51d75"]}) [ 2542.407803] do_syscall_64+0x1d5/0x640 [ 2542.407817] entry_SYSCALL_64_after_hwframe+0x46/0xbb 12:32:44 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="582ce9"]}) 12:32:44 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 5) [ 2542.407826] RIP: 0033:0x7feea38d20e9 [ 2542.407831] RSP: 002b:00007feea2247168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.407841] RAX: ffffffffffffffda RBX: 00007feea39e4f60 RCX: 00007feea38d20e9 [ 2542.407847] RDX: 0000000020000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 2542.407852] RBP: 00007feea22471d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.407857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.407863] R13: 00007ffdd2195d4f R14: 00007feea2247300 R15: 0000000000022000 [ 2542.410370] CPU: 0 PID: 4005 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2542.410376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2542.410379] Call Trace: [ 2542.410395] dump_stack+0x1b2/0x281 [ 2542.410410] should_fail.cold+0x10a/0x149 [ 2542.410423] should_failslab+0xd6/0x130 [ 2542.410435] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2542.410449] __kmalloc_node+0x38/0x70 [ 2542.410463] blk_mq_alloc_rq_map+0x113/0x220 [ 2542.410475] blk_mq_sched_alloc_tags+0xaa/0x240 [ 2542.410489] blk_mq_init_sched+0x18d/0x4a0 [ 2542.410499] ? _raw_spin_unlock+0x29/0x40 [ 2542.410513] elevator_init+0x2ee/0x410 [ 2542.410523] blk_mq_sched_init+0x28/0x40 [ 2542.410533] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2542.410548] blk_mq_init_queue+0x5a/0x90 [ 2542.410558] nbd_dev_add+0x2c6/0x800 [ 2542.410567] ? nbd_send_cmd+0x11f0/0x11f0 [ 2542.410577] ? ns_capable_common+0x127/0x150 [ 2542.410589] nbd_genl_connect+0x3a4/0x1400 [ 2542.410598] ? lock_acquire+0x170/0x3f0 [ 2542.410609] ? nbd_xmit_timeout+0x500/0x500 [ 2542.410617] ? validate_nla+0x192/0x5e0 [ 2542.410625] ? nla_parse+0x157/0x1f0 [ 2542.410637] genl_family_rcv_msg+0x572/0xb20 [ 2542.410649] ? genl_rcv+0x40/0x40 [ 2542.410662] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2542.410682] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2542.410693] ? trace_hardirqs_on+0x10/0x10 [ 2542.410710] genl_rcv_msg+0xaf/0x140 [ 2542.410720] netlink_rcv_skb+0x125/0x390 [ 2542.410729] ? genl_family_rcv_msg+0xb20/0xb20 [ 2542.410739] ? netlink_ack+0x9a0/0x9a0 [ 2542.410748] ? lock_acquire+0x170/0x3f0 [ 2542.410764] genl_rcv+0x24/0x40 [ 2542.410772] netlink_unicast+0x437/0x610 [ 2542.410783] ? netlink_sendskb+0xd0/0xd0 [ 2542.410793] ? __check_object_size+0x179/0x230 [ 2542.410804] netlink_sendmsg+0x648/0xbc0 [ 2542.410816] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.410823] ? kernel_recvmsg+0x210/0x210 [ 2542.410835] ? security_socket_sendmsg+0x83/0xb0 [ 2542.410843] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.410852] sock_sendmsg+0xb5/0x100 [ 2542.410862] ___sys_sendmsg+0x6c8/0x800 [ 2542.410871] ? get_pid_task+0x91/0x130 [ 2542.410880] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.410891] ? lock_downgrade+0x740/0x740 [ 2542.410903] ? __fget+0x23e/0x3e0 [ 2542.410915] ? lock_acquire+0x170/0x3f0 [ 2542.410925] ? lock_downgrade+0x740/0x740 [ 2542.410937] ? __fget+0x265/0x3e0 [ 2542.410952] ? __fdget+0x19b/0x1f0 [ 2542.410961] ? sockfd_lookup_light+0xb2/0x160 [ 2542.410972] __sys_sendmsg+0xa3/0x120 [ 2542.410981] ? SyS_shutdown+0x160/0x160 [ 2542.410992] ? wait_for_completion_io+0x10/0x10 [ 2542.411007] ? SyS_read+0x210/0x210 [ 2542.411017] ? __do_page_fault+0x159/0xad0 [ 2542.411028] SyS_sendmsg+0x27/0x40 [ 2542.411036] ? __sys_sendmsg+0x120/0x120 [ 2542.411046] do_syscall_64+0x1d5/0x640 [ 2542.411059] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.411069] RIP: 0033:0x7fc05f6a20e9 [ 2542.411074] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.411085] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2542.411091] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2542.411096] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.411101] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2542.411106] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2542.488076] nbd: failed to add new device [ 2542.592345] FAULT_INJECTION: forcing a failure. [ 2542.592345] name failslab, interval 1, probability 0, space 0, times 0 [ 2542.592356] CPU: 0 PID: 4047 Comm: syz-executor.3 Not tainted 4.14.277-syzkaller #0 [ 2542.592362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2542.592366] Call Trace: [ 2542.592379] dump_stack+0x1b2/0x281 [ 2542.592394] should_fail.cold+0x10a/0x149 [ 2542.592406] should_failslab+0xd6/0x130 [ 2542.592419] kmem_cache_alloc_node+0x263/0x410 [ 2542.592431] __alloc_skb+0x5c/0x510 [ 2542.592443] netlink_ack+0x216/0x9a0 [ 2542.592453] ? netlink_sendmsg+0xbc0/0xbc0 [ 2542.592466] netlink_rcv_skb+0x2c5/0x390 [ 2542.592475] ? genl_family_rcv_msg+0xb20/0xb20 [ 2542.592485] ? netlink_ack+0x9a0/0x9a0 [ 2542.592495] ? lock_acquire+0x170/0x3f0 [ 2542.592510] genl_rcv+0x24/0x40 [ 2542.592518] netlink_unicast+0x437/0x610 [ 2542.592529] ? netlink_sendskb+0xd0/0xd0 [ 2542.592539] ? __check_object_size+0x179/0x230 [ 2542.592549] netlink_sendmsg+0x648/0xbc0 [ 2542.592561] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.592569] ? kernel_recvmsg+0x210/0x210 [ 2542.592582] ? security_socket_sendmsg+0x83/0xb0 [ 2542.592590] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.592598] sock_sendmsg+0xb5/0x100 [ 2542.592609] ___sys_sendmsg+0x6c8/0x800 [ 2542.592617] ? get_pid_task+0x91/0x130 [ 2542.592626] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.592638] ? lock_downgrade+0x740/0x740 [ 2542.592650] ? __fget+0x23e/0x3e0 [ 2542.592662] ? lock_acquire+0x170/0x3f0 [ 2542.592671] ? lock_downgrade+0x740/0x740 [ 2542.592682] ? __fget+0x265/0x3e0 [ 2542.592695] ? __fdget+0x19b/0x1f0 [ 2542.592704] ? sockfd_lookup_light+0xb2/0x160 [ 2542.592716] __sys_sendmsg+0xa3/0x120 [ 2542.592725] ? SyS_shutdown+0x160/0x160 [ 2542.592736] ? wait_for_completion_io+0x10/0x10 [ 2542.592755] ? SyS_read+0x210/0x210 [ 2542.592777] SyS_sendmsg+0x27/0x40 [ 2542.592786] ? __sys_sendmsg+0x120/0x120 [ 2542.592795] do_syscall_64+0x1d5/0x640 [ 2542.592811] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.592819] RIP: 0033:0x7feea38d20e9 [ 2542.592824] RSP: 002b:00007feea2247168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.592834] RAX: ffffffffffffffda RBX: 00007feea39e4f60 RCX: 00007feea38d20e9 [ 2542.592840] RDX: 0000000020000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 2542.592845] RBP: 00007feea22471d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.592850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.592856] R13: 00007ffdd2195d4f R14: 00007feea2247300 R15: 0000000000022000 [ 2542.603628] FAULT_INJECTION: forcing a failure. [ 2542.603628] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2542.603641] CPU: 1 PID: 4046 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2542.603647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2542.603650] Call Trace: [ 2542.603665] dump_stack+0x1b2/0x281 [ 2542.603680] should_fail.cold+0x10a/0x149 [ 2542.603695] __alloc_pages_nodemask+0x22c/0x2720 [ 2542.603704] ? kasan_kmalloc+0xeb/0x160 [ 2542.603716] ? blk_mq_alloc_rq_map+0x113/0x220 [ 2542.603726] ? blk_mq_sched_alloc_tags+0xaa/0x240 [ 2542.603737] ? elevator_init+0x2ee/0x410 [ 2542.603746] ? blk_mq_sched_init+0x28/0x40 [ 2542.603755] ? blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2542.603766] ? nbd_genl_connect+0x3a4/0x1400 [ 2542.603774] ? genl_family_rcv_msg+0x572/0xb20 [ 2542.603782] ? netlink_rcv_skb+0x125/0x390 [ 2542.603789] ? genl_rcv+0x24/0x40 [ 2542.603797] ? netlink_unicast+0x437/0x610 [ 2542.603804] ? netlink_sendmsg+0x648/0xbc0 [ 2542.603812] ? sock_sendmsg+0xb5/0x100 [ 2542.603820] ? ___sys_sendmsg+0x6c8/0x800 [ 2542.603828] ? __sys_sendmsg+0xa3/0x120 [ 2542.603836] ? SyS_sendmsg+0x27/0x40 [ 2542.603844] ? do_syscall_64+0x1d5/0x640 [ 2542.603853] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.603865] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2542.603882] ? __lockdep_init_map+0x100/0x560 [ 2542.603891] ? _find_next_bit+0xdb/0x100 [ 2542.603903] ? __cpu_to_node+0x7b/0xa0 [ 2542.603913] ? blk_mq_hw_queue_to_node+0x9f/0xf0 [ 2542.603926] blk_mq_alloc_rqs+0x227/0x6d0 [ 2542.603940] ? blk_mq_alloc_rq_map+0x9d/0x220 [ 2542.603953] blk_mq_sched_alloc_tags+0x112/0x240 [ 2542.603966] blk_mq_init_sched+0x18d/0x4a0 [ 2542.603975] ? _raw_spin_unlock+0x29/0x40 [ 2542.603988] elevator_init+0x2ee/0x410 [ 2542.603999] blk_mq_sched_init+0x28/0x40 [ 2542.604010] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2542.604026] blk_mq_init_queue+0x5a/0x90 [ 2542.604035] nbd_dev_add+0x2c6/0x800 [ 2542.604045] ? nbd_send_cmd+0x11f0/0x11f0 [ 2542.604055] ? ns_capable_common+0x127/0x150 [ 2542.604067] nbd_genl_connect+0x3a4/0x1400 [ 2542.604075] ? lock_acquire+0x170/0x3f0 [ 2542.604087] ? nbd_xmit_timeout+0x500/0x500 [ 2542.604098] ? validate_nla+0x192/0x5e0 [ 2542.604108] ? nla_parse+0x157/0x1f0 [ 2542.604121] genl_family_rcv_msg+0x572/0xb20 [ 2542.604149] ? genl_rcv+0x40/0x40 [ 2542.604161] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2542.604173] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2542.604184] ? trace_hardirqs_on+0x10/0x10 [ 2542.604204] genl_rcv_msg+0xaf/0x140 [ 2542.604215] netlink_rcv_skb+0x125/0x390 [ 2542.604226] ? genl_family_rcv_msg+0xb20/0xb20 [ 2542.604237] ? netlink_ack+0x9a0/0x9a0 [ 2542.604246] ? lock_acquire+0x170/0x3f0 [ 2542.604268] genl_rcv+0x24/0x40 [ 2542.604278] netlink_unicast+0x437/0x610 [ 2542.604293] ? netlink_sendskb+0xd0/0xd0 [ 2542.604303] ? __check_object_size+0x179/0x230 [ 2542.604315] netlink_sendmsg+0x648/0xbc0 [ 2542.604327] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.604335] ? kernel_recvmsg+0x210/0x210 [ 2542.604347] ? security_socket_sendmsg+0x83/0xb0 [ 2542.604356] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.604365] sock_sendmsg+0xb5/0x100 [ 2542.604374] ___sys_sendmsg+0x6c8/0x800 [ 2542.604383] ? get_pid_task+0x91/0x130 [ 2542.604392] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.604404] ? lock_downgrade+0x740/0x740 [ 2542.604416] ? __fget+0x23e/0x3e0 [ 2542.604428] ? lock_acquire+0x170/0x3f0 [ 2542.604437] ? lock_downgrade+0x740/0x740 [ 2542.604450] ? __fget+0x265/0x3e0 [ 2542.604464] ? __fdget+0x19b/0x1f0 [ 2542.604473] ? sockfd_lookup_light+0xb2/0x160 [ 2542.604484] __sys_sendmsg+0xa3/0x120 [ 2542.604492] ? SyS_shutdown+0x160/0x160 [ 2542.604501] ? wait_for_completion_io+0x10/0x10 [ 2542.604517] ? SyS_read+0x210/0x210 [ 2542.604526] ? __do_page_fault+0x159/0xad0 [ 2542.604537] SyS_sendmsg+0x27/0x40 [ 2542.604544] ? __sys_sendmsg+0x120/0x120 [ 2542.604552] do_syscall_64+0x1d5/0x640 [ 2542.604566] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.604573] RIP: 0033:0x7fc05f6a20e9 [ 2542.604578] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.604589] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2542.604595] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2542.604600] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.604605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2542.604611] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2542.679375] FAULT_INJECTION: forcing a failure. [ 2542.679375] name failslab, interval 1, probability 0, space 0, times 0 [ 2542.679387] CPU: 0 PID: 4067 Comm: syz-executor.3 Not tainted 4.14.277-syzkaller #0 [ 2542.679393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2542.679397] Call Trace: [ 2542.679411] dump_stack+0x1b2/0x281 [ 2542.679427] should_fail.cold+0x10a/0x149 [ 2542.679442] should_failslab+0xd6/0x130 [ 2542.679456] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2542.679472] __kmalloc_node_track_caller+0x38/0x70 [ 2542.679483] __alloc_skb+0x96/0x510 [ 2542.679495] netlink_ack+0x216/0x9a0 [ 2542.679506] ? netlink_sendmsg+0xbc0/0xbc0 [ 2542.679520] netlink_rcv_skb+0x2c5/0x390 [ 2542.679529] ? genl_family_rcv_msg+0xb20/0xb20 [ 2542.679539] ? netlink_ack+0x9a0/0x9a0 [ 2542.679550] ? lock_acquire+0x170/0x3f0 [ 2542.679566] genl_rcv+0x24/0x40 [ 2542.679574] netlink_unicast+0x437/0x610 [ 2542.679585] ? netlink_sendskb+0xd0/0xd0 [ 2542.679595] ? __check_object_size+0x179/0x230 [ 2542.679606] netlink_sendmsg+0x648/0xbc0 [ 2542.679618] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.679626] ? kernel_recvmsg+0x210/0x210 [ 2542.679638] ? security_socket_sendmsg+0x83/0xb0 [ 2542.679646] ? nlmsg_notify+0x1b0/0x1b0 [ 2542.679656] sock_sendmsg+0xb5/0x100 [ 2542.679665] ___sys_sendmsg+0x6c8/0x800 [ 2542.679674] ? get_pid_task+0x91/0x130 [ 2542.679683] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2542.679694] ? lock_downgrade+0x740/0x740 [ 2542.679707] ? __fget+0x23e/0x3e0 [ 2542.679718] ? lock_acquire+0x170/0x3f0 [ 2542.679728] ? lock_downgrade+0x740/0x740 [ 2542.679740] ? __fget+0x265/0x3e0 [ 2542.679764] ? __fdget+0x19b/0x1f0 [ 2542.679778] ? sockfd_lookup_light+0xb2/0x160 [ 2542.679793] __sys_sendmsg+0xa3/0x120 [ 2542.679803] ? SyS_shutdown+0x160/0x160 [ 2542.679815] ? wait_for_completion_io+0x10/0x10 [ 2542.679833] ? SyS_read+0x210/0x210 [ 2542.679844] SyS_sendmsg+0x27/0x40 [ 2542.679852] ? __sys_sendmsg+0x120/0x120 [ 2542.679862] do_syscall_64+0x1d5/0x640 [ 2542.679877] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2542.679885] RIP: 0033:0x7feea38d20e9 12:32:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000240), 0x400, 0x0) perf_event_open$cgroup(&(0x7f00000001c0)={0x2, 0x80, 0x1f, 0x7, 0x1, 0x40, 0x0, 0x8000000000000001, 0x40040, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0xb22, 0x4, @perf_bp={&(0x7f0000000180), 0x8}, 0x8008, 0xf89, 0xde2e, 0x4, 0x1f, 0x40, 0x8, 0x0, 0x800, 0x0, 0xfffffffffffffffb}, r2, 0x9, r3, 0x8) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x2, 0x70bd25, 0x25dfdbfe, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x3ff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000044) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:45 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="40008ed715a74b234b5e215a49a09fb24b188af4bcfbf5c303c75909e61b5dd474c471ad33190c97fd12339ca2f25a431e2e7679877c83ec47ac400713070dae6c3263f39bef7fcaff1f2a60952c929cbf83848b51b9db7eeb19cd60675688d0da4e25133b9f4029b8ab7cce6cf6166fce3ff354ebb515cb5c9338c4975a92402a75b51d75"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="40008ed715a74b234b5e215a49a09fb24b188af4bcfbf5c303c75909e61b5dd474c471ad33190c97fd12339ca2f25a431e2e7679877c83ec47ac400713070dae6c3263f39bef7fcaff1f2a60952c929cbf83848b51b9db7eeb19cd60675688d0da4e25133b9f4029b8ab7cce6cf6166fce3ff354ebb515cb5c9338c4975a92402a75b51d75"]}) (async) 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYBLOB="582ce9"]}) 12:32:45 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) (fail_nth: 6) 12:32:45 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000040)) (async) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000200)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_DEL_KEY(r4, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0302}}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xaaa2}]}, 0x28}, 0x1, 0x0, 0x0, 0x8}, 0x8060) (async) syz_genetlink_get_family_id$batadv(&(0x7f00000001c0), r3) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), r2) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r2, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), r5) 12:32:45 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 48) [ 2542.679890] RSP: 002b:00007feea2247168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2542.679901] RAX: ffffffffffffffda RBX: 00007feea39e4f60 RCX: 00007feea38d20e9 [ 2542.679906] RDX: 0000000020000004 RSI: 0000000020000200 RDI: 0000000000000003 [ 2542.679912] RBP: 00007feea22471d0 R08: 0000000000000000 R09: 0000000000000000 [ 2542.679917] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2542.679923] R13: 00007ffdd2195d4f R14: 00007feea2247300 R15: 0000000000022000 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.042159] FAULT_INJECTION: forcing a failure. [ 2544.042159] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2544.065177] CPU: 0 PID: 4091 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2544.072984] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2544.082594] Call Trace: [ 2544.085179] dump_stack+0x1b2/0x281 [ 2544.088811] should_fail.cold+0x10a/0x149 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.092969] __alloc_pages_nodemask+0x22c/0x2720 [ 2544.097721] ? kasan_kmalloc+0xeb/0x160 [ 2544.101691] ? blk_mq_alloc_rq_map+0x113/0x220 [ 2544.106270] ? blk_mq_sched_alloc_tags+0xaa/0x240 [ 2544.111106] ? elevator_init+0x2ee/0x410 [ 2544.115163] ? nbd_genl_connect+0x3a4/0x1400 [ 2544.119601] ? genl_family_rcv_msg+0x572/0xb20 [ 2544.124177] ? netlink_rcv_skb+0x125/0x390 [ 2544.128406] ? genl_rcv+0x24/0x40 [ 2544.131857] ? netlink_unicast+0x437/0x610 [ 2544.136085] ? netlink_sendmsg+0x648/0xbc0 [ 2544.140312] ? sock_sendmsg+0xb5/0x100 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.144192] ? ___sys_sendmsg+0x6c8/0x800 [ 2544.148333] ? __sys_sendmsg+0xa3/0x120 [ 2544.152301] ? SyS_sendmsg+0x27/0x40 [ 2544.156014] ? do_syscall_64+0x1d5/0x640 [ 2544.160072] ? entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2544.165434] ? gfp_pfmemalloc_allowed+0x150/0x150 [ 2544.170283] ? __lockdep_init_map+0x100/0x560 [ 2544.174777] ? __lockdep_init_map+0x100/0x560 [ 2544.179271] ? pid_show+0xb0/0xb0 [ 2544.182720] ? debug_mutex_init+0x28/0x60 [ 2544.186870] blk_mq_alloc_rqs+0x227/0x6d0 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.191028] blk_mq_sched_alloc_tags+0x112/0x240 [ 2544.195782] blk_mq_init_sched+0x18d/0x4a0 [ 2544.200019] ? _raw_spin_unlock+0x29/0x40 [ 2544.204169] elevator_init+0x2ee/0x410 [ 2544.208054] blk_mq_sched_init+0x28/0x40 [ 2544.212112] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2544.217217] blk_mq_init_queue+0x5a/0x90 [ 2544.221279] nbd_dev_add+0x2c6/0x800 [ 2544.224992] ? nbd_send_cmd+0x11f0/0x11f0 [ 2544.229139] ? ns_capable_common+0x127/0x150 [ 2544.233564] nbd_genl_connect+0x3a4/0x1400 [ 2544.237791] ? lock_acquire+0x170/0x3f0 12:32:45 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.241765] ? nbd_xmit_timeout+0x500/0x500 [ 2544.246088] ? validate_nla+0x192/0x5e0 [ 2544.250059] ? nla_parse+0x157/0x1f0 [ 2544.253775] genl_family_rcv_msg+0x572/0xb20 [ 2544.258180] ? genl_rcv+0x40/0x40 [ 2544.261631] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2544.267080] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2544.272183] ? trace_hardirqs_on+0x10/0x10 [ 2544.276419] genl_rcv_msg+0xaf/0x140 [ 2544.280127] netlink_rcv_skb+0x125/0x390 [ 2544.284181] ? genl_family_rcv_msg+0xb20/0xb20 [ 2544.288756] ? netlink_ack+0x9a0/0x9a0 [ 2544.292640] ? lock_acquire+0x170/0x3f0 [ 2544.296693] genl_rcv+0x24/0x40 [ 2544.299966] netlink_unicast+0x437/0x610 [ 2544.304036] ? netlink_sendskb+0xd0/0xd0 [ 2544.308092] ? __check_object_size+0x179/0x230 [ 2544.312670] netlink_sendmsg+0x648/0xbc0 [ 2544.316728] ? nlmsg_notify+0x1b0/0x1b0 [ 2544.320693] ? kernel_recvmsg+0x210/0x210 [ 2544.324837] ? security_socket_sendmsg+0x83/0xb0 [ 2544.329594] ? nlmsg_notify+0x1b0/0x1b0 [ 2544.333564] sock_sendmsg+0xb5/0x100 [ 2544.337272] ___sys_sendmsg+0x6c8/0x800 [ 2544.341249] ? get_pid_task+0x91/0x130 [ 2544.345131] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2544.349883] ? lock_downgrade+0x740/0x740 [ 2544.354019] ? __fget+0x23e/0x3e0 [ 2544.357451] ? lock_acquire+0x170/0x3f0 [ 2544.361404] ? lock_downgrade+0x740/0x740 [ 2544.365531] ? __fget+0x265/0x3e0 [ 2544.368966] ? __fdget+0x19b/0x1f0 [ 2544.372484] ? sockfd_lookup_light+0xb2/0x160 [ 2544.377132] __sys_sendmsg+0xa3/0x120 [ 2544.380921] ? SyS_shutdown+0x160/0x160 [ 2544.384876] ? wait_for_completion_io+0x10/0x10 [ 2544.389545] ? SyS_read+0x210/0x210 [ 2544.393152] ? __do_page_fault+0x159/0xad0 [ 2544.397363] SyS_sendmsg+0x27/0x40 [ 2544.400878] ? __sys_sendmsg+0x120/0x120 [ 2544.404916] do_syscall_64+0x1d5/0x640 [ 2544.408783] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2544.413947] RIP: 0033:0x7fc05f6a20e9 [ 2544.417635] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2544.425320] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2544.432674] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2544.439923] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2544.447180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2544.454436] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcecf5"]}) 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:46 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x10000005}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f00000003c0)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r4, 0x89f4, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x4, 0x4, 0x0, 0x3, 0x23, @mcast2, @loopback, 0x8, 0x40, 0x2800, 0x1000}}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c000000daa8bcc08a9bd5e92fd3f6059daa5a2daa4420ce431acbeae3c00d3d6f9454ded8c92f517a64b4b217f41bd380a2b5", @ANYRES16=r2, @ANYBLOB="01000000000000000000030000000500060003000000080009000000000008000c0000000000"], 0x2c}}, 0x20000004) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) setsockopt$inet6_dccp_buf(r5, 0x21, 0xc0, &(0x7f0000000080)="19ab6d4914622170d2edf3c03b2259a6a6ceeb4916e15791df57e3cab80b9a8c2dd0dad8bcb31bbc3994a60b4d82c6d47841a540f47675c4d909e24358c5a6d81505f2899877b3552bc169e507a0261b1bdfb397943c07cac28607d911af9972ddbd91f528ac3b837c3e15c5dbcb77de65f82440c35f2974fb2ecc90616fed97fbc565c6f7376c2b3a57493fb69c48d67ffa81ceef4db9ba7cfe44a5c0f5879f2a52eef83df3d74a692500", 0xab) 12:32:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/timer\x00', 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) socket$vsock_dgram(0x28, 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004105}, 0x2404c8c2) 12:32:46 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 49) 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcecf5"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcecf5"]}) (async) 12:32:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/timer\x00', 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) socket$vsock_dgram(0x28, 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004105}, 0x2404c8c2) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/timer\x00', 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) socket$vsock_dgram(0x28, 0x2, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004105}, 0x2404c8c2) (async) 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) 12:32:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcecf5"]}) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74b7285e942086b98e1b24b188af4bcecf5"]}) (async) 12:32:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/timer\x00', 0x0, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local}}}}) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) socket$vsock_dgram(0x28, 0x2, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) sendmsg$L2TP_CMD_SESSION_DELETE(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000080)={&(0x7f00000001c0)={0x1c, 0x0, 0x8, 0x70bd28, 0x25dfdbfd, {}, [@L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e23}]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004105}, 0x2404c8c2) [ 2544.646872] FAULT_INJECTION: forcing a failure. [ 2544.646872] name failslab, interval 1, probability 0, space 0, times 0 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.710737] CPU: 0 PID: 4157 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2544.718549] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2544.727898] Call Trace: [ 2544.730509] dump_stack+0x1b2/0x281 [ 2544.734136] should_fail.cold+0x10a/0x149 [ 2544.738279] should_failslab+0xd6/0x130 [ 2544.742249] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2544.747353] elevator_alloc+0x7a/0x1f0 [ 2544.751231] dd_init_queue+0x20/0x420 [ 2544.755032] blk_mq_init_sched+0x214/0x4a0 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) [ 2544.759266] ? _raw_spin_unlock+0x29/0x40 [ 2544.763412] elevator_init+0x2ee/0x410 [ 2544.767303] blk_mq_sched_init+0x28/0x40 [ 2544.771361] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2544.776468] blk_mq_init_queue+0x5a/0x90 [ 2544.780527] nbd_dev_add+0x2c6/0x800 [ 2544.784235] ? nbd_send_cmd+0x11f0/0x11f0 [ 2544.788377] ? ns_capable_common+0x127/0x150 [ 2544.792780] nbd_genl_connect+0x3a4/0x1400 [ 2544.797017] ? lock_acquire+0x170/0x3f0 [ 2544.800976] ? nbd_xmit_timeout+0x500/0x500 [ 2544.805286] ? validate_nla+0x192/0x5e0 [ 2544.809258] ? nla_parse+0x157/0x1f0 [ 2544.812971] genl_family_rcv_msg+0x572/0xb20 [ 2544.817375] ? genl_rcv+0x40/0x40 [ 2544.820810] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2544.826241] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2544.831321] ? trace_hardirqs_on+0x10/0x10 [ 2544.835536] genl_rcv_msg+0xaf/0x140 [ 2544.839224] netlink_rcv_skb+0x125/0x390 [ 2544.843263] ? genl_family_rcv_msg+0xb20/0xb20 [ 2544.847821] ? netlink_ack+0x9a0/0x9a0 [ 2544.851689] ? lock_acquire+0x170/0x3f0 [ 2544.855643] genl_rcv+0x24/0x40 [ 2544.858898] netlink_unicast+0x437/0x610 [ 2544.862940] ? netlink_sendskb+0xd0/0xd0 [ 2544.866984] ? __check_object_size+0x179/0x230 [ 2544.871553] netlink_sendmsg+0x648/0xbc0 [ 2544.875591] ? nlmsg_notify+0x1b0/0x1b0 [ 2544.879539] ? kernel_recvmsg+0x210/0x210 [ 2544.883665] ? security_socket_sendmsg+0x83/0xb0 [ 2544.888394] ? nlmsg_notify+0x1b0/0x1b0 [ 2544.892348] sock_sendmsg+0xb5/0x100 [ 2544.896037] ___sys_sendmsg+0x6c8/0x800 [ 2544.899986] ? get_pid_task+0x91/0x130 [ 2544.903854] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2544.908589] ? lock_downgrade+0x740/0x740 [ 2544.912727] ? __fget+0x23e/0x3e0 [ 2544.916155] ? lock_acquire+0x170/0x3f0 [ 2544.920104] ? lock_downgrade+0x740/0x740 [ 2544.924229] ? __fget+0x265/0x3e0 [ 2544.927663] ? __fdget+0x19b/0x1f0 [ 2544.931180] ? sockfd_lookup_light+0xb2/0x160 [ 2544.935650] __sys_sendmsg+0xa3/0x120 [ 2544.939429] ? SyS_shutdown+0x160/0x160 [ 2544.943390] ? wait_for_completion_io+0x10/0x10 [ 2544.948046] ? SyS_read+0x210/0x210 [ 2544.951648] ? __do_page_fault+0x159/0xad0 [ 2544.955860] SyS_sendmsg+0x27/0x40 [ 2544.959375] ? __sys_sendmsg+0x120/0x120 [ 2544.963411] do_syscall_64+0x1d5/0x640 [ 2544.967279] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2544.972450] RIP: 0033:0x7fc05f6a20e9 [ 2544.976136] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2544.983820] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2544.991068] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2544.998318] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 12:32:46 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x10000005}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f00000003c0)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r4, 0x89f4, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x4, 0x4, 0x0, 0x3, 0x23, @mcast2, @loopback, 0x8, 0x40, 0x2800, 0x1000}}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c000000daa8bcc08a9bd5e92fd3f6059daa5a2daa4420ce431acbeae3c00d3d6f9454ded8c92f517a64b4b217f41bd380a2b5", @ANYRES16=r2, @ANYBLOB="01000000000000000000030000000500060003000000080009000000000008000c0000000000"], 0x2c}}, 0x20000004) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) setsockopt$inet6_dccp_buf(r5, 0x21, 0xc0, &(0x7f0000000080)="19ab6d4914622170d2edf3c03b2259a6a6ceeb4916e15791df57e3cab80b9a8c2dd0dad8bcb31bbc3994a60b4d82c6d47841a540f47675c4d909e24358c5a6d81505f2899877b3552bc169e507a0261b1bdfb397943c07cac28607d911af9972ddbd91f528ac3b837c3e15c5dbcb77de65f82440c35f2974fb2ecc90616fed97fbc565c6f7376c2b3a57493fb69c48d67ffa81ceef4db9ba7cfe44a5c0f5879f2a52eef83df3d74a692500", 0xab) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x10000005}) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f00000003c0)) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r4, 0x89f4, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x4, 0x4, 0x0, 0x3, 0x23, @mcast2, @loopback, 0x8, 0x40, 0x2800, 0x1000}}) (async) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c000000daa8bcc08a9bd5e92fd3f6059daa5a2daa4420ce431acbeae3c00d3d6f9454ded8c92f517a64b4b217f41bd380a2b5", @ANYRES16=r2, @ANYBLOB="01000000000000000000030000000500060003000000080009000000000008000c0000000000"], 0x2c}}, 0x20000004) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) (async) setsockopt$inet6_dccp_buf(r5, 0x21, 0xc0, &(0x7f0000000080)="19ab6d4914622170d2edf3c03b2259a6a6ceeb4916e15791df57e3cab80b9a8c2dd0dad8bcb31bbc3994a60b4d82c6d47841a540f47675c4d909e24358c5a6d81505f2899877b3552bc169e507a0261b1bdfb397943c07cac28607d911af9972ddbd91f528ac3b837c3e15c5dbcb77de65f82440c35f2974fb2ecc90616fed97fbc565c6f7376c2b3a57493fb69c48d67ffa81ceef4db9ba7cfe44a5c0f5879f2a52eef83df3d74a692500", 0xab) (async) 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:46 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 50) 12:32:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="400004000000000000e942084898dab24b188af4bcfbf5"]}) socket$inet6_udp(0xa, 0x2, 0x0) 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, 0x0, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@L2TP_ATTR_RECV_SEQ={0x5}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x40}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$watch_queue(r1, &(0x7f0000000040)=""/47, 0x2f) [ 2545.005570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2545.012818] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2545.039186] nbd: failed to add new device 12:32:46 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:46 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$watch_queue(r1, &(0x7f0000000040)=""/47, 0x2f) 12:32:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="400004000000000000e942084898dab24b188af4bcfbf5"]}) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="400004000000000000e942084898dab24b188af4bcfbf5"]}) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x6, 0x3f) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x2e}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44004000}, 0x40010) [ 2545.153938] FAULT_INJECTION: forcing a failure. [ 2545.153938] name failslab, interval 1, probability 0, space 0, times 0 [ 2545.192773] CPU: 1 PID: 4209 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2545.200589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2545.209939] Call Trace: [ 2545.212526] dump_stack+0x1b2/0x281 [ 2545.216162] should_fail.cold+0x10a/0x149 [ 2545.220325] should_failslab+0xd6/0x130 [ 2545.224313] kmem_cache_alloc_node_trace+0x25a/0x400 [ 2545.229432] dd_init_queue+0x94/0x420 [ 2545.233234] blk_mq_init_sched+0x214/0x4a0 [ 2545.237479] ? _raw_spin_unlock+0x29/0x40 [ 2545.241637] elevator_init+0x2ee/0x410 [ 2545.245524] blk_mq_sched_init+0x28/0x40 [ 2545.249582] blk_mq_init_allocated_queue+0xca0/0xfd0 [ 2545.254689] blk_mq_init_queue+0x5a/0x90 [ 2545.258749] nbd_dev_add+0x2c6/0x800 [ 2545.262462] ? nbd_send_cmd+0x11f0/0x11f0 [ 2545.266616] ? ns_capable_common+0x127/0x150 [ 2545.271023] nbd_genl_connect+0x3a4/0x1400 [ 2545.275251] ? lock_acquire+0x170/0x3f0 [ 2545.279246] ? nbd_xmit_timeout+0x500/0x500 [ 2545.283570] ? validate_nla+0x192/0x5e0 [ 2545.287551] ? nla_parse+0x157/0x1f0 [ 2545.291263] genl_family_rcv_msg+0x572/0xb20 [ 2545.295671] ? genl_rcv+0x40/0x40 [ 2545.299119] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x6, 0x3f) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x2e}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44004000}, 0x40010) [ 2545.304562] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2545.309660] ? trace_hardirqs_on+0x10/0x10 [ 2545.313905] genl_rcv_msg+0xaf/0x140 [ 2545.317616] netlink_rcv_skb+0x125/0x390 [ 2545.321682] ? genl_family_rcv_msg+0xb20/0xb20 [ 2545.326261] ? netlink_ack+0x9a0/0x9a0 [ 2545.330145] ? lock_acquire+0x170/0x3f0 [ 2545.334126] genl_rcv+0x24/0x40 [ 2545.337403] netlink_unicast+0x437/0x610 [ 2545.341460] ? netlink_sendskb+0xd0/0xd0 [ 2545.345519] ? __check_object_size+0x179/0x230 [ 2545.350097] netlink_sendmsg+0x648/0xbc0 12:32:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x6, 0x3f) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x2e}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44004000}, 0x40010) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) socket$inet6(0xa, 0x6, 0x3f) (async) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, 0x0, 0x200, 0x70bd25, 0x25dfdbfd, {}, [@L2TP_ATTR_OFFSET={0x6, 0x3, 0x1}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x2e}}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6=r2}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x44004000}, 0x40010) (async) [ 2545.354155] ? nlmsg_notify+0x1b0/0x1b0 [ 2545.358125] ? kernel_recvmsg+0x210/0x210 [ 2545.362286] ? security_socket_sendmsg+0x83/0xb0 [ 2545.367042] ? nlmsg_notify+0x1b0/0x1b0 [ 2545.371448] sock_sendmsg+0xb5/0x100 [ 2545.375162] ___sys_sendmsg+0x6c8/0x800 [ 2545.379131] ? get_pid_task+0x91/0x130 [ 2545.383017] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2545.387944] ? lock_downgrade+0x740/0x740 [ 2545.392101] ? __fget+0x23e/0x3e0 [ 2545.395552] ? lock_acquire+0x170/0x3f0 [ 2545.399518] ? lock_downgrade+0x740/0x740 [ 2545.403664] ? __fget+0x265/0x3e0 [ 2545.407119] ? __fdget+0x19b/0x1f0 [ 2545.410656] ? sockfd_lookup_light+0xb2/0x160 [ 2545.415148] __sys_sendmsg+0xa3/0x120 [ 2545.418941] ? SyS_shutdown+0x160/0x160 [ 2545.422915] ? wait_for_completion_io+0x10/0x10 [ 2545.427591] ? SyS_read+0x210/0x210 [ 2545.431214] ? __do_page_fault+0x159/0xad0 [ 2545.435448] SyS_sendmsg+0x27/0x40 [ 2545.438983] ? __sys_sendmsg+0x120/0x120 [ 2545.443036] do_syscall_64+0x1d5/0x640 [ 2545.446927] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2545.452125] RIP: 0033:0x7fc05f6a20e9 [ 2545.455829] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2545.463635] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2545.470904] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2545.478173] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2545.485435] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2545.492702] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 12:32:47 executing program 3: r0 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r0, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f0000000000)={0x10000005}) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r3, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f00000003c0)) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r3, 0xc0189375, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r4, 0x89f4, &(0x7f0000000340)={'syztnl0\x00', &(0x7f00000002c0)={'sit0\x00', 0x0, 0x4, 0x4, 0x0, 0x3, 0x23, @mcast2, @loopback, 0x8, 0x40, 0x2800, 0x1000}}) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c000000daa8bcc08a9bd5e92fd3f6059daa5a2daa4420ce431acbeae3c00d3d6f9454ded8c92f517a64b4b217f41bd380a2b5", @ANYRES16=r2, @ANYBLOB="01000000000000000000030000000500060003000000080009000000000008000c0000000000"], 0x2c}}, 0x20000004) (async) r5 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r5, 0x0, 0x0) setsockopt$inet6_dccp_buf(r5, 0x21, 0xc0, &(0x7f0000000080)="19ab6d4914622170d2edf3c03b2259a6a6ceeb4916e15791df57e3cab80b9a8c2dd0dad8bcb31bbc3994a60b4d82c6d47841a540f47675c4d909e24358c5a6d81505f2899877b3552bc169e507a0261b1bdfb397943c07cac28607d911af9972ddbd91f528ac3b837c3e15c5dbcb77de65f82440c35f2974fb2ecc90616fed97fbc565c6f7376c2b3a57493fb69c48d67ffa81ceef4db9ba7cfe44a5c0f5879f2a52eef83df3d74a692500", 0xab) 12:32:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:47 executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000080), r0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x30, r1, 0x1, 0x0, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}, @NBD_ATTR_SOCKETS={0x4}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x30}}, 0x0) (fail_nth: 51) 12:32:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) read$watch_queue(r1, &(0x7f0000000040)=""/47, 0x2f) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000000)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) read$watch_queue(r1, &(0x7f0000000040)=""/47, 0x2f) (async) 12:32:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="400004000000000000e942084898dab24b188af4bcfbf5"]}) (async) socket$inet6_udp(0xa, 0x2, 0x0) 12:32:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) [ 2545.513814] nbd: failed to add new device 12:32:47 executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000140)=ANY=[@ANYBLOB='erspan0\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYBLOB="582ce9"]}) 12:32:47 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_MODIFY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x38, r1, 0x1, 0x0, 0x0, {}, [@L2TP_ATTR_IP6_DADDR={0x14, 0x20, @local}, @L2TP_ATTR_CONN_ID={0x8}, @L2TP_ATTR_PEER_SESSION_ID={0x8}]}, 0x38}}, 0x20000004) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x250002, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x400, 0x70bd27, 0x25dfdbfb}, 0x14}}, 0x0) 12:32:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000080)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x8, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local, {[@ssrr={0x89, 0xb, 0xf1, [@private=0xa010102, @dev={0xac, 0x14, 0x14, 0x1d}]}]}}}}}) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x2}) 12:32:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) socket$inet6_udp(0xa, 0x2, 0x0) (async) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) [ 2545.615532] FAULT_INJECTION: forcing a failure. [ 2545.615532] name failslab, interval 1, probability 0, space 0, times 0 12:32:47 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="40008ed715a74be385e942086b98e1b24b188af4bcfbf5"]}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000006c0)={&(0x7f0000000280)=@flushsa={0x310, 0x1c, 0x400, 0x70bd2a, 0x25dfdbfc, {0xff}, [@algo_comp={0x67, 0x3, {{'lzjh\x00'}, 0xf8, "d29a7602794815f8b84c9ba3b89cfebe47eed40429da7acca505a7e3ec42b6"}}, @tmpl={0x184, 0x5, [{{@in=@multicast1, 0x4d2, 0x33}, 0x2, @in6=@mcast1, 0x3502, 0x1, 0x1, 0x1b, 0x2d70, 0x4, 0x34a}, {{@in=@loopback, 0x4d3, 0x3c}, 0xa, @in=@multicast1, 0x34ff, 0x3, 0x2, 0x20, 0x7, 0x0, 0x3ff}, {{@in=@private=0xa010102, 0x4d4, 0xff}, 0x2, @in6=@mcast2, 0x34ff, 0x4, 0x3, 0x1, 0x0, 0x8, 0x20}, {{@in=@private=0xa010102, 0x4d2, 0xcd}, 0x2, @in=@loopback, 0x3506, 0x1, 0x2, 0x6, 0x6ab3, 0x80000000, 0x400}, {{@in6=@loopback, 0x4d3, 0x3c}, 0x2, @in=@rand_addr=0x64010102, 0x3505, 0x3, 0x0, 0x2, 0xffff, 0x4, 0xffffffff}, {{@in=@local, 0x4d2, 0x32}, 0xa, @in6=@private1, 0x3505, 0x1, 0x1, 0x6, 0x1f, 0x3, 0x10000}]}, @lifetime_val={0x24, 0x9, {0x7fffffffffffffff, 0x0, 0xfff, 0x1f}}, @replay_thresh={0x8, 0xb, 0x1f}, @algo_crypt={0xcc, 0x2, {{'xts-twofish-avx\x00'}, 0x420, "b2376893b3470908afeef0804af6603f9d00280cf96931ac8f48c0af54e92aae022eb81046a60b78a0b458cec5423b641bcdcd836b0e00d92e0669a1869e00ba0e22bfadcab0bdfa123ba12524a1ef33a1abb30043255f7871f7c4c7cc539df782945ce2b2dfc037128bdd116ecbac3a1243a541fa541968fe18a47ddfcbfdaac7be415d"}}, @policy_type={0xa}, @mark={0xc, 0x15, {0x35075a, 0x2}}]}, 0x310}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wpan0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000007c0)={'syztnl2\x00', &(0x7f0000000740)={'sit0\x00', 0x0, 0x29, 0x1f, 0x1, 0x5, 0x1, @local, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x8000, 0x80, 0x72b, 0xfffffffb}}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="c0000000", @ANYRES16=0x0, @ANYBLOB="08022bbd7000fe6adf251500000008001f00040000000813870d679ee72530d837000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=r1, @ANYBLOB="0c000600020000000200000005001e00010000000c000600000000000000000008000300", @ANYRES32=0x0, @ANYBLOB="6c0020800c0005002825000000000000080004000300000008000400000000000800010002000000200003800c0004000202aaaaaaaaaaaa0616030001000020060001000300000005000200020000eb0b0005000400000000000000040003800c0005000000000000000000"], 0xc0}, 0x1, 0x0, 0x0, 0x4004000}, 0x801) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r2, 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r2, 0xae00, 0x0) 12:32:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) (async) r1 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) sendmsg$BATADV_CMD_GET_GATEWAYS(r1, 0x0, 0x0) (async, rerun: 32) getsockopt$inet6_udp_int(r1, 0x11, 0xb, &(0x7f0000000040), &(0x7f0000000080)=0x4) (rerun: 32) [ 2545.720304] CPU: 1 PID: 4280 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2545.728110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2545.737458] Call Trace: [ 2545.740040] dump_stack+0x1b2/0x281 [ 2545.743674] should_fail.cold+0x10a/0x149 [ 2545.747824] should_failslab+0xd6/0x130 [ 2545.751800] kmem_cache_alloc_trace+0x29a/0x3d0 [ 2545.756470] device_create_groups_vargs+0x7b/0x250 [ 2545.761398] device_create_vargs+0x3a/0x50 [ 2545.765638] bdi_register_va.part.0+0x35/0x650 [ 2545.770222] bdi_register+0x101/0x110 [ 2545.774019] ? bdi_register_va+0x80/0x80 [ 2545.778082] ? vsnprintf+0x260/0x1340 [ 2545.781886] bdi_register_owner+0x59/0xf0 [ 2545.786037] device_add_disk+0x5bb/0xdc0 [ 2545.790095] ? sprintf+0xa7/0xd0 [ 2545.793461] ? blk_alloc_devt+0x310/0x310 [ 2545.797703] ? __lockdep_init_map+0x100/0x560 [ 2545.802196] ? __lockdep_init_map+0x100/0x560 [ 2545.806692] nbd_dev_add+0x60e/0x800 [ 2545.810404] ? nbd_send_cmd+0x11f0/0x11f0 [ 2545.814548] ? ns_capable_common+0x127/0x150 [ 2545.818962] nbd_genl_connect+0x3a4/0x1400 [ 2545.823195] ? lock_acquire+0x170/0x3f0 [ 2545.827170] ? nbd_xmit_timeout+0x500/0x500 [ 2545.831491] ? validate_nla+0x192/0x5e0 [ 2545.835462] ? nla_parse+0x157/0x1f0 [ 2545.839178] genl_family_rcv_msg+0x572/0xb20 [ 2545.843590] ? genl_rcv+0x40/0x40 [ 2545.847044] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2545.852488] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2545.857597] ? trace_hardirqs_on+0x10/0x10 [ 2545.861827] genl_rcv_msg+0xaf/0x140 [ 2545.865528] netlink_rcv_skb+0x125/0x390 [ 2545.869574] ? genl_family_rcv_msg+0xb20/0xb20 [ 2545.874133] ? netlink_ack+0x9a0/0x9a0 [ 2545.878001] ? lock_acquire+0x170/0x3f0 [ 2545.881956] genl_rcv+0x24/0x40 [ 2545.885221] netlink_unicast+0x437/0x610 [ 2545.889267] ? netlink_sendskb+0xd0/0xd0 [ 2545.893305] ? __check_object_size+0x179/0x230 [ 2545.897866] netlink_sendmsg+0x648/0xbc0 [ 2545.901910] ? nlmsg_notify+0x1b0/0x1b0 [ 2545.905866] ? kernel_recvmsg+0x210/0x210 [ 2545.910003] ? security_socket_sendmsg+0x83/0xb0 [ 2545.914764] ? nlmsg_notify+0x1b0/0x1b0 [ 2545.918725] sock_sendmsg+0xb5/0x100 [ 2545.922417] ___sys_sendmsg+0x6c8/0x800 [ 2545.926369] ? get_pid_task+0x91/0x130 [ 2545.930235] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2545.934978] ? lock_downgrade+0x740/0x740 [ 2545.939112] ? __fget+0x23e/0x3e0 [ 2545.942541] ? lock_acquire+0x170/0x3f0 [ 2545.946496] ? lock_downgrade+0x740/0x740 [ 2545.950626] ? __fget+0x265/0x3e0 [ 2545.954058] ? __fdget+0x19b/0x1f0 [ 2545.957576] ? sockfd_lookup_light+0xb2/0x160 [ 2545.962050] __sys_sendmsg+0xa3/0x120 [ 2545.965835] ? SyS_shutdown+0x160/0x160 [ 2545.969788] ? wait_for_completion_io+0x10/0x10 [ 2545.974459] ? SyS_read+0x210/0x210 [ 2545.978071] ? __do_page_fault+0x159/0xad0 [ 2545.982293] SyS_sendmsg+0x27/0x40 [ 2545.985989] ? __sys_sendmsg+0x120/0x120 [ 2545.990036] do_syscall_64+0x1d5/0x640 [ 2545.993947] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2545.999113] RIP: 0033:0x7fc05f6a20e9 [ 2546.002801] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2546.010485] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 12:32:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELPRL(r0, 0x89f6, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000040)={'ip6_vti0\x00', 0x0, 0x2f, 0x1, 0x7, 0x6, 0x20, @remote, @rand_addr=' \x01\x00', 0x20, 0x80, 0x9, 0x6}}) setsockopt$inet6_udp_int(r0, 0x11, 0x65, &(0x7f0000000000), 0x4) 12:32:47 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'gre0\x00', &(0x7f0000000080)={'erspan0\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0x8, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, @multicast1, @local, {[@ssrr={0x89, 0xb, 0xf1, [@private=0xa010102, @dev={0xac, 0x14, 0x14, 0x1d}]}]}}}}}) (async) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x2}) [ 2546.017733] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2546.024984] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2546.032238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2546.039489] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2546.075923] kasan: CONFIG_KASAN_INLINE enabled [ 2546.080796] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 2546.088222] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 2546.094437] Modules linked in: [ 2546.097624] CPU: 1 PID: 4280 Comm: syz-executor.2 Not tainted 4.14.277-syzkaller #0 [ 2546.105418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2546.114769] task: ffff88809cf482c0 task.stack: ffff8880aeb80000 [ 2546.120824] RIP: 0010:sysfs_do_create_link_sd+0x56/0x120 [ 2546.126262] RSP: 0018:ffff8880aeb874e0 EFLAGS: 00010202 [ 2546.131617] RAX: dffffc0000000000 RBX: 0000000000000010 RCX: 0000000000007b75 [ 2546.138877] RDX: 0000000000000008 RSI: 0000000000000001 RDI: 0000000000000040 [ 2546.146148] RBP: ffffffff87cbc3e0 R08: ffffffff8b9e3668 R09: 00000000000400c7 [ 2546.153427] R10: ffff88809cf48bc0 R11: ffff88809cf482c0 R12: ffff8880ae93a1c0 [ 2546.160688] R13: ffffffff87cbc3e0 R14: 0000000000000001 R15: ffff8880aaf1cb9c [ 2546.167949] FS: 00007fc05e017700(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 [ 2546.176162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2546.182039] CR2: 00007f3e59b82000 CR3: 00000000ab24c000 CR4: 00000000003406e0 [ 2546.189301] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2546.196565] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2546.203823] Call Trace: [ 2546.206410] sysfs_create_link+0x5f/0xc0 [ 2546.210468] device_add_disk+0x9f8/0xdc0 [ 2546.214526] ? sprintf+0xa7/0xd0 [ 2546.217875] ? blk_alloc_devt+0x310/0x310 [ 2546.222000] ? __lockdep_init_map+0x100/0x560 [ 2546.226471] ? __lockdep_init_map+0x100/0x560 [ 2546.230948] nbd_dev_add+0x60e/0x800 [ 2546.234647] ? nbd_send_cmd+0x11f0/0x11f0 [ 2546.238777] ? ns_capable_common+0x127/0x150 [ 2546.243163] nbd_genl_connect+0x3a4/0x1400 [ 2546.247387] ? lock_acquire+0x170/0x3f0 [ 2546.251337] ? nbd_xmit_timeout+0x500/0x500 [ 2546.255637] ? validate_nla+0x192/0x5e0 [ 2546.259585] ? nla_parse+0x157/0x1f0 [ 2546.263276] genl_family_rcv_msg+0x572/0xb20 [ 2546.267660] ? genl_rcv+0x40/0x40 [ 2546.271090] ? __ww_mutex_wakeup_for_backoff+0x210/0x210 [ 2546.276519] ? __kmalloc_node_track_caller+0x4c/0x70 [ 2546.281599] ? trace_hardirqs_on+0x10/0x10 [ 2546.285816] genl_rcv_msg+0xaf/0x140 [ 2546.289509] netlink_rcv_skb+0x125/0x390 [ 2546.293566] ? genl_family_rcv_msg+0xb20/0xb20 [ 2546.298134] ? netlink_ack+0x9a0/0x9a0 [ 2546.302001] ? lock_acquire+0x170/0x3f0 [ 2546.305956] genl_rcv+0x24/0x40 [ 2546.309213] netlink_unicast+0x437/0x610 [ 2546.313258] ? netlink_sendskb+0xd0/0xd0 [ 2546.317297] ? __check_object_size+0x179/0x230 [ 2546.321858] netlink_sendmsg+0x648/0xbc0 [ 2546.325899] ? nlmsg_notify+0x1b0/0x1b0 [ 2546.329850] ? kernel_recvmsg+0x210/0x210 [ 2546.333976] ? security_socket_sendmsg+0x83/0xb0 [ 2546.338710] ? nlmsg_notify+0x1b0/0x1b0 [ 2546.342664] sock_sendmsg+0xb5/0x100 [ 2546.346369] ___sys_sendmsg+0x6c8/0x800 [ 2546.350387] ? get_pid_task+0x91/0x130 [ 2546.354250] ? copy_msghdr_from_user+0x3b0/0x3b0 [ 2546.358983] ? lock_downgrade+0x740/0x740 [ 2546.363107] ? __fget+0x23e/0x3e0 [ 2546.366535] ? lock_acquire+0x170/0x3f0 [ 2546.370491] ? lock_downgrade+0x740/0x740 [ 2546.374625] ? __fget+0x265/0x3e0 [ 2546.378063] ? __fdget+0x19b/0x1f0 [ 2546.381577] ? sockfd_lookup_light+0xb2/0x160 [ 2546.386047] __sys_sendmsg+0xa3/0x120 [ 2546.389834] ? SyS_shutdown+0x160/0x160 [ 2546.393793] ? wait_for_completion_io+0x10/0x10 [ 2546.398442] ? SyS_read+0x210/0x210 [ 2546.402066] ? __do_page_fault+0x159/0xad0 [ 2546.406280] SyS_sendmsg+0x27/0x40 [ 2546.409795] ? __sys_sendmsg+0x120/0x120 [ 2546.413828] do_syscall_64+0x1d5/0x640 [ 2546.417695] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 2546.422868] RIP: 0033:0x7fc05f6a20e9 [ 2546.426557] RSP: 002b:00007fc05e017168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2546.434237] RAX: ffffffffffffffda RBX: 00007fc05f7b4f60 RCX: 00007fc05f6a20e9 [ 2546.441570] RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000004 [ 2546.448817] RBP: 00007fc05e0171d0 R08: 0000000000000000 R09: 0000000000000000 [ 2546.456061] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2546.463308] R13: 00007ffeff15ab8f R14: 00007fc05e017300 R15: 0000000000022000 [ 2546.470555] Code: 84 a1 00 00 00 e8 0b 64 b1 ff 48 c7 c7 40 ce 04 89 e8 8f 9a 80 05 48 8d 7b 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a7 00 00 00 4c 8b 6b 30 4d 85 ed 74 4f e8 d2 [ 2546.489639] RIP: sysfs_do_create_link_sd+0x56/0x120 RSP: ffff8880aeb874e0 [ 2546.496779] ---[ end trace 6165ce801eb71302 ]--- [ 2546.501533] Kernel panic - not syncing: Fatal exception [ 2546.507049] Kernel Offset: disabled [ 2546.510654] Rebooting in 86400 seconds..