0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TIOCMGET(r0, 0x5415, 0x0)
bind$bt_rfcomm(r0, 0x0, 0x11a)
ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000280))
gettid()
getresuid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000240))
lstat(&(0x7f0000000580)='./file0\x00', &(0x7f00000008c0))
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000980))
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000009c0)={{{@in=@empty, @in6=@ipv4={[], [], @remote}}}, {{@in=@empty}, 0x0, @in6=@local}}, &(0x7f0000000ac0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000b40))
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000d00))
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@local, @in=@dev}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000e40)=0xe8)
r2 = gettid()
stat(&(0x7f0000000e80)='./file0\x00', &(0x7f0000000ec0))
lstat(&(0x7f0000000f40)='./file0\x00', &(0x7f00000002c0))
fstat(r1, &(0x7f0000005380))
getpgrp(r2)
stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000005500))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000005700), &(0x7f0000005740)=0xc)
fcntl$getown(r1, 0x9)
r3 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x101002)
write$evdev(r3, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfe72)

10:11:35 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, 0x0, 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3326.386394][T19111] device nr0
 entered promiscuous mode
10:11:35 executing program 1:
perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x3f, 0x4, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b4, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f0000000140)='./file0\x00', 0x3fffffc)
write$P9_RREAD(r0, 0x0, 0x0)
fallocate(r0, 0xfffffffffffc, 0x0, 0xfff)
sched_setaffinity(0x0, 0xffffffffffffff6b, &(0x7f0000000940)=0x5)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TIOCMGET(r0, 0x5415, 0x0)
bind$bt_rfcomm(r0, 0x0, 0x11a)
ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000280))
gettid()
getresuid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000240))
lstat(&(0x7f0000000580)='./file0\x00', &(0x7f00000008c0))
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000980))
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000009c0)={{{@in=@empty, @in6=@ipv4={[], [], @remote}}}, {{@in=@empty}, 0x0, @in6=@local}}, &(0x7f0000000ac0)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, &(0x7f0000000b40))
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000d00))
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@local, @in=@dev}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000e40)=0xe8)
r2 = gettid()
stat(&(0x7f0000000e80)='./file0\x00', &(0x7f0000000ec0))
lstat(&(0x7f0000000f40)='./file0\x00', &(0x7f00000002c0))
fstat(r1, &(0x7f0000005380))
getpgrp(r2)
stat(&(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000005500))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000005700), &(0x7f0000005740)=0xc)
fcntl$getown(r1, 0x9)
r3 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x101002)
write$evdev(r3, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfe72)

10:11:35 executing program 2:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r0, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x8100000, 0x0)

10:11:35 executing program 0:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:35 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, 0x0, 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:35 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, 0x0, 0x0)

10:11:35 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)

10:11:35 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:35 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, 0x0, 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:35 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:35 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)

10:11:35 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, 0x0, 0x0)

10:11:35 executing program 1:
perf_event_open(&(0x7f0000000340)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1000000000, 0x3f, 0x4, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b4, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f0000000140)='./file0\x00', 0x3fffffc)
write$P9_RREAD(r0, 0x0, 0x0)
sched_setaffinity(0x0, 0xffffffffffffff6b, &(0x7f0000000940)=0x5)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
bind$bt_rfcomm(r0, 0x0, 0x11a)
getresuid(&(0x7f0000000400), &(0x7f0000000440), &(0x7f0000000240))
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000980))
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000d00))
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@local, @in=@dev}}, {{@in6=@initdev}, 0x0, @in=@dev}}, &(0x7f0000000e40)=0xe8)
r2 = gettid()
stat(0x0, &(0x7f0000000ec0))
lstat(&(0x7f0000000f40)='./file0\x00', 0x0)
fstat(r1, 0x0)
getpgrp(r2)
stat(0x0, &(0x7f0000005500))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000005700), &(0x7f0000005740)=0xc)
fcntl$getown(r1, 0x9)
r3 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x101002)
write$evdev(r3, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfe72)

10:11:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, 0x0, 0x0)

10:11:36 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)

10:11:36 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

10:11:36 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:36 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x0, 0x0)

[ 3327.452743][T19139] device nr0
 entered promiscuous mode
10:11:36 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:36 executing program 1:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
shutdown(0xffffffffffffffff, 0x0)
write$P9_RFLUSH(r1, &(0x7f0000000040), 0xffffff7e)
write$P9_RLCREATE(r1, &(0x7f0000000080)={0x18}, 0x18)
dup2(r1, r0)

10:11:36 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

10:11:36 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:36 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x0, 0x0)

10:11:36 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)

10:11:36 executing program 1:

10:11:37 executing program 2:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x0, 0x0)

10:11:37 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:37 executing program 1:

[ 3328.342878][T19263] device nr0
 entered promiscuous mode
10:11:37 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

10:11:37 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:37 executing program 2:

10:11:37 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:37 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:37 executing program 1:

10:11:37 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

10:11:37 executing program 2:

10:11:37 executing program 1:

10:11:38 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:38 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0)

10:11:38 executing program 2:

10:11:38 executing program 1:

[ 3329.307279][T19289] device nr0
 entered promiscuous mode
10:11:38 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:38 executing program 2:

[ 3329.894478][T19301] device nr0
 entered promiscuous mode
10:11:38 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:38 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:38 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:38 executing program 1:

10:11:38 executing program 2:

10:11:38 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:38 executing program 1:

10:11:38 executing program 2:

10:11:38 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:39 executing program 2:

10:11:39 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:39 executing program 1:

[ 3330.482748][T19320] device nr0
 entered promiscuous mode
10:11:39 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

10:11:39 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:39 executing program 2:

10:11:39 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:39 executing program 1:

10:11:39 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:39 executing program 2:

10:11:39 executing program 1:

[ 3331.065481][T19330] 9pnet: Insufficient options for proto=fd
10:11:39 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:39 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x0, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:39 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

10:11:39 executing program 2:

[ 3331.138046][T19325] device nr0
 entered promiscuous mode
10:11:40 executing program 2:

10:11:40 executing program 1:

10:11:40 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:40 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x0, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3331.300333][T19340] 9pnet: Insufficient options for proto=fd
10:11:40 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

[ 3331.535005][T19348] 9pnet: Insufficient options for proto=fd
10:11:40 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:40 executing program 2:

10:11:40 executing program 1:

10:11:40 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x0, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:40 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:40 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:40 executing program 2:

10:11:40 executing program 1:

10:11:40 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r1, 0x1, 0x0, 0x0, {0xf}}, 0x14}}, 0x0)

10:11:40 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(0x0, &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:40 executing program 2:

10:11:40 executing program 1:

[ 3332.093657][T19358] device nr0
 entered promiscuous mode
10:11:41 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:41 executing program 1:

10:11:41 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(0x0, &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:41 executing program 2:

10:11:41 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r1, 0x1, 0x0, 0x0, {0xf}}, 0x14}}, 0x0)

10:11:41 executing program 1:

10:11:41 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:41 executing program 2:

10:11:41 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r1, 0x1, 0x0, 0x0, {0xf}}, 0x14}}, 0x0)

10:11:41 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(0x0, &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:41 executing program 1:

10:11:41 executing program 2:

[ 3332.892782][T19375] device nr0
 entered promiscuous mode
10:11:42 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:42 executing program 1:

10:11:42 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x5010, 0x0)

10:11:42 executing program 2:

10:11:42 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x18, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0x4}]}, 0x18}}, 0x0)

10:11:42 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x18, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0x4}]}, 0x18}}, 0x0)

10:11:42 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:42 executing program 1:

10:11:42 executing program 2:

10:11:42 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x5010, 0x0)

[ 3333.543389][T19394] device nr0
 entered promiscuous mode
10:11:42 executing program 0:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x18, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0x4}]}, 0x18}}, 0x0)

10:11:42 executing program 1:

10:11:42 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:42 executing program 2:

10:11:42 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x5010, 0x0)

10:11:42 executing program 1:

10:11:42 executing program 0:

10:11:43 executing program 2:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$evdev(&(0x7f00000000c0)='/dev/input/event#\x00', 0x0, 0x101002)
write$evdev(r0, &(0x7f0000000000)=[{{0x0, 0x7530}}], 0xfe72)

[ 3334.391608][T19413] device nr0
 entered promiscuous mode
10:11:43 executing program 1:

10:11:43 executing program 0:

10:11:43 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:43 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x0, 0x0)

10:11:43 executing program 2:
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x1000008912, &(0x7f00000000c0)="11dc86055e0bceec7be070")
r1 = socket(0x10, 0x2, 0x0)
syslog(0x3, &(0x7f00000000c0)=""/147, 0x37a8ec531be3c41f)
open(&(0x7f0000000e00)='./file1\x00', 0x0, 0x0)
mount(&(0x7f0000000280)=ANY=[], &(0x7f0000026ff8)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)='mountstats\x00')
sendfile(r1, r2, 0x0, 0x80000008000000b)

10:11:43 executing program 0:
r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x5, 0x0)
ioctl$EVIOCREVOKE(r0, 0x40044591, 0x0)

10:11:43 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:43 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:43 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x0, 0x0)

10:11:43 executing program 2:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:43 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:43 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x0, 0x0)

10:11:44 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3335.243828][T19444] device nr0
 entered promiscuous mode
10:11:44 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:44 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 2:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:44 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3336.098081][T19579] device nr0
 entered promiscuous mode
10:11:44 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:45 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:45 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:45 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
socket$kcm(0x29, 0x7, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:45 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:45 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:45 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3336.796974][T19713] device nr0
 entered promiscuous mode
10:11:45 executing program 2:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:46 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:46 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:46 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:46 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
socket$kcm(0x29, 0x7, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:46 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)

10:11:46 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:46 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:46 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3337.554066][T19843] encrypted_key: insufficient parameters specified
10:11:46 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)

10:11:46 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:46 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3337.732184][T19844] device nr0
 entered promiscuous mode
[ 3337.771279][T19854] encrypted_key: insufficient parameters specified
10:11:46 executing program 2:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)

10:11:46 executing program 1:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
r3 = socket$kcm(0x29, 0x7, 0x0)
sendmsg$kcm(r3, &(0x7f0000000940)={&(0x7f0000000780)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x2, 0x2, 0x0, {0xa, 0x4e22, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffff7}}}, 0x80, 0x0}, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
openat$tun(0xffffffffffffff9c, 0x0, 0x101003, 0x0)
sendmsg$kcm(r3, 0x0, 0x800)
bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0)
sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:46 executing program 4:
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r0 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r0}})

10:11:46 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)

[ 3337.987548][T19868] encrypted_key: insufficient parameters specified
10:11:47 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:47 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)
sendfile(r3, r8, 0x0, 0x800000000024)

10:11:47 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)

10:11:47 executing program 4:
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r0 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r0}})

10:11:47 executing program 1:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x0, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:47 executing program 2:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
socket$kcm(0x29, 0x7, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:47 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)

10:11:47 executing program 4:
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r0 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r0}})

10:11:47 executing program 1:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x0, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:47 executing program 4:
r0 = socket$unix(0x1, 0x0, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:47 executing program 1:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x0, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3338.694850][T19882] device nr0
 entered promiscuous mode
10:11:47 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)

[ 3339.166731][T19894] device nr0
 entered promiscuous mode
10:11:48 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)
sendfile(r3, r8, 0x0, 0x800000000024)

10:11:48 executing program 4:
r0 = socket$unix(0x1, 0x0, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:48 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
socket(0x100000000000011, 0x3, 0x0)

10:11:48 executing program 2:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
socket$kcm(0x29, 0x7, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 4:
r0 = socket$unix(0x1, 0x0, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:48 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 3:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0xff49)
splice(r0, 0x0, r2, 0x0, 0x810000f, 0x0)

10:11:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)

10:11:48 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)

10:11:48 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:48 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)

10:11:48 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3340.133772][T20033] device nr0
 entered promiscuous mode
10:11:49 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)
sendfile(r3, r8, 0x0, 0x800000000024)

10:11:49 executing program 2 (fault-call:5 fault-nth:0):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:49 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(0xffffffffffffffff, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:49 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)

10:11:49 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)

10:11:49 executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x400000000000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_NMI(0xffffffffffffffff, 0xae9a)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$KVM_SMI(r2, 0xaeb7)
r3 = socket$inet6(0xa, 0x400000000001, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, <r4=>0x0})
prlimit64(r4, 0x5, &(0x7f00000002c0)={0x4, 0x7}, &(0x7f0000000300))
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = accept4(r3, &(0x7f0000000080)=@sco, &(0x7f0000000100)=0x80, 0x800)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r5, 0x12, 0x2, &(0x7f0000000140)=""/229, &(0x7f0000000240)=0xe5)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0x1000}, 0x1c2, 0x0)
r6 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r6, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f319bd070")
add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180)={'.yz'}, &(0x7f0000000100), 0xca, 0xfffffffffffffffe)
close(r3)
r7 = socket(0x100000000000011, 0x3, 0x0)
bind(r7, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
r8 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
ftruncate(r8, 0x88001)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)
sendfile(r3, r8, 0x0, 0x800000000024)

10:11:49 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, 0x0, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:49 executing program 1 (fault-call:2 fault-nth:0):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:49 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3341.001691][T20164] FAULT_INJECTION: forcing a failure.
[ 3341.001691][T20164] name failslab, interval 1, probability 0, space 0, times 0
[ 3341.094316][T20164] CPU: 1 PID: 20164 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3341.103409][T20164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3341.113966][T20164] Call Trace:
[ 3341.117279][T20164]  dump_stack+0x172/0x1f0
[ 3341.121633][T20164]  should_fail.cold+0xa/0x15
[ 3341.126248][T20164]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3341.132077][T20164]  ? ___might_sleep+0x163/0x280
[ 3341.132099][T20164]  __should_failslab+0x121/0x190
[ 3341.132114][T20164]  should_failslab+0x9/0x14
[ 3341.132128][T20164]  __kmalloc_track_caller+0x2d5/0x740
[ 3341.132145][T20164]  ? strnlen_user+0x132/0x2e0
[ 3341.132156][T20164]  ? strndup_user+0x77/0xd0
[ 3341.132172][T20164]  memdup_user+0x26/0xb0
[ 3341.132186][T20164]  strndup_user+0x77/0xd0
[ 3341.132213][T20164]  ksys_mount+0x7b/0x150
[ 3341.132239][T20164]  __x64_sys_mount+0xbe/0x150
[ 3341.156552][T20164]  do_syscall_64+0xfd/0x680
[ 3341.156575][T20164]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3341.156593][T20164] RIP: 0033:0x459279
[ 3341.188943][T20164] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3341.188954][T20164] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3341.188969][T20164] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3341.188977][T20164] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:11:50 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, 0x0, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3341.188984][T20164] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3341.188992][T20164] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3341.189000][T20164] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:50 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:50 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, 0x0, 0x0)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:50 executing program 2 (fault-call:5 fault-nth:1):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:50 executing program 0 (fault-call:5 fault-nth:0):
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:50 executing program 3 (fault-call:1 fault-nth:0):
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3341.580388][T20278] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:50 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:50 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x2, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3341.701896][T20288] FAULT_INJECTION: forcing a failure.
[ 3341.701896][T20288] name failslab, interval 1, probability 0, space 0, times 0
[ 3341.737456][T20288] CPU: 0 PID: 20288 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3341.746544][T20288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3341.756625][T20288] Call Trace:
[ 3341.759937][T20288]  dump_stack+0x172/0x1f0
[ 3341.764294][T20288]  should_fail.cold+0xa/0x15
[ 3341.768921][T20288]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3341.774743][T20288]  ? ___might_sleep+0x163/0x280
[ 3341.779611][T20288]  __should_failslab+0x121/0x190
[ 3341.784558][T20288]  should_failslab+0x9/0x14
[ 3341.789162][T20288]  kmem_cache_alloc+0x2af/0x6f0
[ 3341.794031][T20288]  ? find_held_lock+0x35/0x130
[ 3341.798997][T20288]  ? __might_fault+0x12b/0x1e0
[ 3341.803783][T20288]  getname_flags+0xd6/0x5b0
[ 3341.808301][T20288]  user_path_at_empty+0x2f/0x50
[ 3341.813189][T20288]  do_mount+0x150/0x1c00
[ 3341.817454][T20288]  ? copy_mount_string+0x40/0x40
[ 3341.822412][T20288]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3341.828668][T20288]  ? _copy_from_user+0x12c/0x1a0
[ 3341.833648][T20288]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3341.839911][T20288]  ? copy_mount_options+0x2db/0x3f0
[ 3341.845126][T20288]  ksys_mount+0xdb/0x150
[ 3341.849389][T20288]  __x64_sys_mount+0xbe/0x150
[ 3341.854080][T20288]  do_syscall_64+0xfd/0x680
[ 3341.858602][T20288]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3341.864502][T20288] RIP: 0033:0x459279
[ 3341.868406][T20288] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3341.888044][T20288] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
10:11:50 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:50 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:50 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3341.896474][T20288] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3341.904544][T20288] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3341.912525][T20288] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3341.920541][T20288] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3341.928536][T20288] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3341.955200][T20212] device nr0
 entered promiscuous mode
10:11:51 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:51 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0x2, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:51 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
close(r0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a1, &(0x7f0000000000)='rose0\x00')
splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x8100000, 0x0)

10:11:51 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x0, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:51 executing program 2 (fault-call:5 fault-nth:2):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3342.275312][T20299] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3342.298221][T20300] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:51 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x3, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:51 executing program 0:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
fsetxattr$security_smack_transmute(r0, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f00000000c0)='TRUE', 0x4, 0x1)
openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x402, 0x0)

[ 3342.435134][T20308] FAULT_INJECTION: forcing a failure.
[ 3342.435134][T20308] name failslab, interval 1, probability 0, space 0, times 0
[ 3342.478865][T20308] CPU: 0 PID: 20308 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3342.487940][T20308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3342.487958][T20308] Call Trace:
[ 3342.501368][T20308]  dump_stack+0x172/0x1f0
[ 3342.505721][T20308]  should_fail.cold+0xa/0x15
[ 3342.510336][T20308]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3342.516162][T20308]  ? ___might_sleep+0x163/0x280
[ 3342.521036][T20308]  __should_failslab+0x121/0x190
[ 3342.525995][T20308]  should_failslab+0x9/0x14
[ 3342.530508][T20308]  kmem_cache_alloc+0x2af/0x6f0
[ 3342.535375][T20308]  ? __might_fault+0x12b/0x1e0
[ 3342.540156][T20308]  getname_flags+0xd6/0x5b0
[ 3342.540177][T20308]  user_path_at_empty+0x2f/0x50
[ 3342.540195][T20308]  do_mount+0x150/0x1c00
[ 3342.540216][T20308]  ? copy_mount_string+0x40/0x40
[ 3342.540239][T20308]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3342.564965][T20308]  ? _copy_from_user+0x12c/0x1a0
[ 3342.564995][T20308]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
10:11:51 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:51 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xa, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3342.576171][T20308]  ? copy_mount_options+0x2db/0x3f0
[ 3342.581389][T20308]  ksys_mount+0xdb/0x150
[ 3342.585653][T20308]  __x64_sys_mount+0xbe/0x150
[ 3342.590348][T20308]  do_syscall_64+0xfd/0x680
[ 3342.594873][T20308]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3342.594886][T20308] RIP: 0033:0x459279
[ 3342.594902][T20308] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
10:11:51 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x2}, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3342.594910][T20308] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3342.624305][T20308] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3342.624315][T20308] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3342.624324][T20308] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3342.624333][T20308] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3342.624342][T20308] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3342.697029][T20319] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:51 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:51 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x1c}, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3342.866888][T20316] device nr0
 entered promiscuous mode
[ 3342.888002][T20330] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3343.274603][T20333] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:52 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:52 executing program 2 (fault-call:5 fault-nth:3):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:52 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000200))
getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000100)=@assoc_id=<r2=>0x0, &(0x7f0000000140)=0x4)
getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000180)={r2, 0xffff}, &(0x7f00000001c0)=0x8)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$RTC_WIE_OFF(r0, 0x7010)
close(r3)
setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000000)={0x8f, @local, 0x4e20, 0x2, 'wlc\x00', 0x2, 0x6, 0x20}, 0x2c)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000280)={'bridge_slave_1\x00', {0x2, 0x4e22, @rand_addr=0x9}})
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r3, 0x0, 0x8100000, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0)

10:11:52 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x200000c0}, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:52 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x5, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:52 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3343.389244][T20338] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:52 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x6, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3343.442444][T20355] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3343.488298][T20346] FAULT_INJECTION: forcing a failure.
[ 3343.488298][T20346] name failslab, interval 1, probability 0, space 0, times 0
10:11:52 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00')
sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0xf8, r2, 0x102, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x67}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x8, 0xd, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xffffffff7fffffff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x927b}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xff}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x38, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@ipv4={[], [], @rand_addr=0x4}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x8, 0x20}}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}]}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xbb}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0xf8}, 0x1, 0x0, 0x0, 0x200408c0}, 0x24040000)
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
openat$capi20(0xffffffffffffff9c, &(0x7f0000000340)='/dev/capi20\x00', 0x2, 0x0)
syz_open_procfs(0x0, &(0x7f0000000000)='oom_adj\x00')
splice(r0, 0x0, r3, 0x0, 0x8100000, 0x0)

[ 3343.578844][T20346] CPU: 1 PID: 20346 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3343.587928][T20346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3343.597999][T20346] Call Trace:
[ 3343.601316][T20346]  dump_stack+0x172/0x1f0
[ 3343.605673][T20346]  should_fail.cold+0xa/0x15
[ 3343.610294][T20346]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3343.616121][T20346]  ? ___might_sleep+0x163/0x280
[ 3343.620989][T20346]  __should_failslab+0x121/0x190
10:11:52 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3343.625949][T20346]  should_failslab+0x9/0x14
[ 3343.630466][T20346]  __kmalloc+0x2d9/0x740
[ 3343.634727][T20346]  ? save_stack+0x5c/0x90
[ 3343.639079][T20346]  ? save_stack+0x23/0x90
[ 3343.643417][T20346]  ? tomoyo_encode2.part.0+0xf5/0x400
[ 3343.648814][T20346]  tomoyo_encode2.part.0+0xf5/0x400
[ 3343.654040][T20346]  ? do_syscall_64+0xfd/0x680
[ 3343.658740][T20346]  tomoyo_encode+0x2b/0x50
[ 3343.663180][T20346]  tomoyo_mount_acl+0xe0/0x840
[ 3343.667986][T20346]  ? kasan_check_write+0x14/0x20
[ 3343.672952][T20346]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3343.678512][T20346]  ? lock_downgrade+0x880/0x880
[ 3343.683563][T20346]  ? mark_held_locks+0xf0/0xf0
[ 3343.688363][T20346]  ? lock_acquire+0x16f/0x3f0
[ 3343.693053][T20346]  ? tomoyo_mount_permission+0x10a/0x410
[ 3343.698703][T20346]  tomoyo_mount_permission+0x16a/0x410
[ 3343.704185][T20346]  ? tomoyo_mount_permission+0x10a/0x410
[ 3343.709835][T20346]  ? tomoyo_mount_acl+0x840/0x840
[ 3343.714875][T20346]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3343.721150][T20346]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3343.727408][T20346]  ? strncpy_from_user+0x2b4/0x400
[ 3343.732560][T20346]  tomoyo_sb_mount+0x35/0x40
[ 3343.737171][T20346]  security_sb_mount+0x87/0xd0
[ 3343.741962][T20346]  do_mount+0x1d4/0x1c00
[ 3343.746238][T20346]  ? copy_mount_string+0x40/0x40
[ 3343.751200][T20346]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3343.757453][T20346]  ? _copy_from_user+0x12c/0x1a0
[ 3343.762410][T20346]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3343.768690][T20346]  ? copy_mount_options+0x2db/0x3f0
[ 3343.773916][T20346]  ksys_mount+0xdb/0x150
10:11:52 executing program 0:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = add_key(&(0x7f0000000000)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000100)="f155e9df21ec6c5af6473e17702fcc8c4e00592ebd9ec453a32712bebbe00190", 0x20, 0xfffffffffffffffc)
r3 = request_key(&(0x7f0000000140)='syzkaller\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='oom_adj\x00', 0x0)
keyctl$negate(0xd, r2, 0x0, r3)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
close(r4)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r4, 0x0, 0x8100000, 0x0)

[ 3343.778185][T20346]  __x64_sys_mount+0xbe/0x150
[ 3343.782901][T20346]  do_syscall_64+0xfd/0x680
[ 3343.787440][T20346]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3343.793348][T20346] RIP: 0033:0x459279
[ 3343.797273][T20346] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3343.816897][T20346] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
10:11:52 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x1c}, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3343.817813][T20354] device nr0
 entered promiscuous mode
[ 3343.825364][T20346] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3343.825372][T20346] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3343.825380][T20346] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3343.825388][T20346] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3343.825397][T20346] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:52 executing program 2 (fault-call:5 fault-nth:4):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3343.893579][T20455] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3344.046415][T20463] FAULT_INJECTION: forcing a failure.
[ 3344.046415][T20463] name failslab, interval 1, probability 0, space 0, times 0
[ 3344.074012][T20463] CPU: 1 PID: 20463 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3344.083094][T20463] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3344.093168][T20463] Call Trace:
[ 3344.096496][T20463]  dump_stack+0x172/0x1f0
[ 3344.100865][T20463]  should_fail.cold+0xa/0x15
[ 3344.105495][T20463]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3344.112824][T20463]  ? ___might_sleep+0x163/0x280
[ 3344.117707][T20463]  __should_failslab+0x121/0x190
[ 3344.122661][T20463]  should_failslab+0x9/0x14
[ 3344.127181][T20463]  kmem_cache_alloc_trace+0x2ce/0x750
[ 3344.132575][T20463]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 3344.138312][T20463]  ? strncpy_from_user+0x2b4/0x400
[ 3344.143454][T20463]  getname_flags+0x33f/0x5b0
[ 3344.148070][T20463]  user_path_at_empty+0x2f/0x50
[ 3344.152944][T20463]  do_mount+0x150/0x1c00
[ 3344.157221][T20463]  ? copy_mount_string+0x40/0x40
[ 3344.162180][T20463]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.168451][T20463]  ? _copy_from_user+0x12c/0x1a0
[ 3344.174247][T20463]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.180512][T20463]  ? copy_mount_options+0x2db/0x3f0
[ 3344.185733][T20463]  ksys_mount+0xdb/0x150
[ 3344.190003][T20463]  __x64_sys_mount+0xbe/0x150
[ 3344.194700][T20463]  do_syscall_64+0xfd/0x680
[ 3344.199236][T20463]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3344.205146][T20463] RIP: 0033:0x459279
[ 3344.209059][T20463] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3344.228678][T20463] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3344.237110][T20463] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3344.245095][T20463] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3344.253093][T20463] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3344.261084][T20463] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3344.269072][T20463] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3344.300203][T20459] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:53 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x200000c0}, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:11:53 executing program 2 (fault-call:5 fault-nth:5):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:53 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000000)={0xba, 0x0, 0x101}, 0xc)
r3 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00')
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000140)={{{@in, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000280)=0xe8)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000002c0)={<r5=>0x0, @broadcast, @initdev}, &(0x7f0000000f80)=0x2a9)
getpeername$packet(r0, &(0x7f0000003780)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000037c0)=0x14)
accept4$packet(r0, &(0x7f0000003800)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000003840)=0x14, 0x80800)
getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000003880)={{{@in=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@initdev}}}, &(0x7f0000003980)=0xe8)
fcntl$setsig(r1, 0xa, 0x26)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f00000039c0)={<r9=>0x0, @dev, @remote}, &(0x7f0000003a00)=0xc)
getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000003a40)={@multicast1, @initdev, <r10=>0x0}, &(0x7f0000003a80)=0xc)
ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f00000007c0)={0xf, 0x2, 0x4, 0x84000, r1})
ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000003c40)={'team0\x00', <r11=>0x0})
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000003c80)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0}}, {{@in6=@initdev}, 0x0, @in=@local}}, &(0x7f0000003d80)=0xe8)
getpeername$packet(0xffffffffffffffff, &(0x7f0000003e00)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000003e40)=0x14)
getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000003f40)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in6=@initdev}, 0x0, @in=@multicast1}}, &(0x7f0000004040)=0xe8)
getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000047c0)={@loopback, @rand_addr, <r15=>0x0}, &(0x7f0000004800)=0xc)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000004840)={'vcan0\x00', <r16=>0x0})
sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000004d80)={&(0x7f0000000080), 0xc, &(0x7f0000004d40)={&(0x7f0000000300)=ANY=[@ANYBLOB="9c040000", @ANYRES16=r3, @ANYBLOB="010229bd7000fddbdf250200000008000100", @ANYRES32=r4, @ANYBLOB="cc0102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r5, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f6164636173740000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="6c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000003c0004000d03ff0207000000000802010700000008000608001000000002180006000000ffff040006000000fdff00f102000000ff7f3f00050000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000ad8000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000000010008000100", @ANYRES32=r8, @ANYBLOB="3c00020038000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400cd19000008000100", @ANYRES32=r9, @ANYBLOB="ac0102003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r10, @ANYBLOB="3c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r11, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74654eb78ed17276616c00000000000000000000000800030003000000080004000000000040006c625f707bd0ab14e5d6267fb08fd2df6f72745f737461747300000000000000000000000000000000000000080003000b0000000800040001000000080006000000000000", @ANYRES32=r12, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000101000008000600", @ANYRES32=r13, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000100000008000600", @ANYRES32=r14, @ANYBLOB="08000100", @ANYRES32=r15, @ANYBLOB="b40002003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400000000803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r16], 0x49c}, 0x1, 0x0, 0x0, 0x1}, 0x40001)
write$cgroup_int(r1, &(0x7f0000000040)=0x7, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000800)={'security\x00', 0x83, "7e7de690048115e770d6751d804d66df09d4ce807dda641854ec2b10ec66921e846037d22d84532b3ac6705b8af341a8dafaa83d47ded9e4df88de1c22963f731583cee17a8c803ace5ad6ecbc931ae4cba2d95cec592edd258bfb66740e01893b8fd5b23ef63299e97e7c9674828cbe47d4d5c428f70cbf13b25cbd9b182c62ca7353"}, &(0x7f00000008c0)=0xa7)

10:11:53 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:53 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(0xffffffffffffffff)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x1c}, @bcast, @null, @null, @netrom]}, 0x40)

10:11:53 executing program 0:
pipe(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:53 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3344.581002][T20476] FAULT_INJECTION: forcing a failure.
[ 3344.581002][T20476] name failslab, interval 1, probability 0, space 0, times 0
[ 3344.634119][T20476] CPU: 1 PID: 20476 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3344.643246][T20476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3344.653329][T20476] Call Trace:
[ 3344.656653][T20476]  dump_stack+0x172/0x1f0
[ 3344.661021][T20476]  should_fail.cold+0xa/0x15
[ 3344.665643][T20476]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3344.671479][T20476]  ? ___might_sleep+0x163/0x280
[ 3344.676353][T20476]  __should_failslab+0x121/0x190
[ 3344.681307][T20476]  should_failslab+0x9/0x14
[ 3344.685817][T20476]  __kmalloc+0x2d9/0x740
[ 3344.690075][T20476]  ? save_stack+0x5c/0x90
[ 3344.694418][T20476]  ? save_stack+0x23/0x90
[ 3344.698757][T20476]  ? tomoyo_encode2.part.0+0xf5/0x400
[ 3344.704151][T20476]  tomoyo_encode2.part.0+0xf5/0x400
[ 3344.705352][T20477] device nr0
 entered promiscuous mode
[ 3344.709365][T20476]  ? do_syscall_64+0xfd/0x680
[ 3344.709388][T20476]  tomoyo_encode+0x2b/0x50
[ 3344.709404][T20476]  tomoyo_mount_acl+0xe0/0x840
[ 3344.709424][T20476]  ? kasan_check_write+0x14/0x20
[ 3344.709440][T20476]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3344.709453][T20476]  ? lock_downgrade+0x880/0x880
[ 3344.709473][T20476]  ? mark_held_locks+0xf0/0xf0
[ 3344.709508][T20476]  ? lock_acquire+0x16f/0x3f0
[ 3344.709522][T20476]  ? tomoyo_mount_permission+0x10a/0x410
[ 3344.709545][T20476]  tomoyo_mount_permission+0x16a/0x410
[ 3344.764632][T20476]  ? tomoyo_mount_permission+0x10a/0x410
[ 3344.770295][T20476]  ? tomoyo_mount_acl+0x840/0x840
[ 3344.775338][T20476]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.781610][T20476]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.787865][T20476]  ? strncpy_from_user+0x2b4/0x400
[ 3344.792996][T20476]  tomoyo_sb_mount+0x35/0x40
[ 3344.797600][T20476]  security_sb_mount+0x87/0xd0
[ 3344.802391][T20476]  do_mount+0x1d4/0x1c00
[ 3344.802416][T20476]  ? copy_mount_string+0x40/0x40
[ 3344.802433][T20476]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.802454][T20476]  ? _copy_from_user+0x12c/0x1a0
[ 3344.817868][T20476]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3344.817888][T20476]  ? copy_mount_options+0x2db/0x3f0
[ 3344.817907][T20476]  ksys_mount+0xdb/0x150
[ 3344.817928][T20476]  __x64_sys_mount+0xbe/0x150
[ 3344.843206][T20476]  do_syscall_64+0xfd/0x680
[ 3344.847728][T20476]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3344.854944][T20476] RIP: 0033:0x459279
[ 3344.858860][T20476] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
10:11:53 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$KVM_GET_IRQCHIP(r0, 0xc208ae62, &(0x7f0000000500))
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f00000002c0)=@get={0x1, &(0x7f0000000200)=""/178, 0x20})
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000100))
syz_open_procfs(0x0, &(0x7f0000000040)='schedstat\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:53 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xe, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default={0x98, 0x92, 0x9c, 0xaa, 0xb0, 0x200000c0}, @bcast, @null, @null, @netrom]}, 0x40)

[ 3344.878486][T20476] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3344.886913][T20476] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3344.894900][T20476] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3344.902888][T20476] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3344.910879][T20476] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3344.918867][T20476] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:54 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:54 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$KDGETLED(r1, 0x4b31, &(0x7f0000000000))
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r0)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:54 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x1c}, @null, @null, @netrom]}, 0x40)

10:11:54 executing program 2 (fault-call:5 fault-nth:6):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:54 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(0x0, 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x48, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:54 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x200000c0}, @null, @null, @netrom]}, 0x40)

10:11:54 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl(r0, 0x0, &(0x7f0000000000)="00b4a11da2faaf983b9881ef95a9bf42de718e05f23c3366284ade61755891dafb3cf7b26d3c53f276c9999539e0b482192e26bf647ed67547c94e3c4df63e82951b0f02fcf3c92410210d8f3cf2b8050e61ca1b16a7fe58999b32461c178574ec0ffc9192125db7cf")
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3345.602755][T20504] FAULT_INJECTION: forcing a failure.
[ 3345.602755][T20504] name failslab, interval 1, probability 0, space 0, times 0
10:11:54 executing program 0:
pipe(&(0x7f0000000340)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
listxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)=""/182, 0xb6)
wait4(0x0, &(0x7f0000000040), 0x1, &(0x7f0000000100))
prctl$PR_SET_TIMERSLACK(0x1d, 0x8000)
ioctl$EVIOCGID(r3, 0x80084502, &(0x7f0000000000)=""/41)
epoll_create1(0x80003)
write$P9_RRENAME(r0, &(0x7f00000001c0)={0x7, 0x15, 0x1}, 0x7)

[ 3345.654265][T20504] CPU: 1 PID: 20504 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3345.663352][T20504] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3345.673429][T20504] Call Trace:
[ 3345.676742][T20504]  dump_stack+0x172/0x1f0
[ 3345.681110][T20504]  should_fail.cold+0xa/0x15
[ 3345.685739][T20504]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3345.691588][T20504]  ? ___might_sleep+0x163/0x280
[ 3345.696468][T20504]  __should_failslab+0x121/0x190
[ 3345.701420][T20504]  should_failslab+0x9/0x14
[ 3345.705931][T20504]  __kmalloc+0x2d9/0x740
[ 3345.710190][T20504]  ? tomoyo_realpath_from_path+0xc0/0x7a0
[ 3345.715937][T20504]  ? rcu_read_lock_sched_held+0x110/0x130
[ 3345.721677][T20504]  ? tomoyo_realpath_from_path+0xcd/0x7a0
[ 3345.726912][T20506] device nr0
 entered promiscuous mode
[ 3345.727421][T20504]  tomoyo_realpath_from_path+0xcd/0x7a0
[ 3345.727447][T20504]  tomoyo_mount_acl+0x149/0x840
[ 3345.727469][T20504]  ? kasan_check_write+0x14/0x20
[ 3345.748262][T20504]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
10:11:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4c, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3345.753833][T20504]  ? lock_downgrade+0x880/0x880
[ 3345.758712][T20504]  ? mark_held_locks+0xf0/0xf0
[ 3345.763531][T20504]  ? lock_acquire+0x16f/0x3f0
[ 3345.768231][T20504]  ? tomoyo_mount_permission+0x10a/0x410
[ 3345.773894][T20504]  tomoyo_mount_permission+0x16a/0x410
[ 3345.779380][T20504]  ? tomoyo_mount_permission+0x10a/0x410
[ 3345.785038][T20504]  ? tomoyo_mount_acl+0x840/0x840
[ 3345.790080][T20504]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3345.796352][T20504]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3345.802615][T20504]  ? strncpy_from_user+0x2b4/0x400
[ 3345.807745][T20504]  tomoyo_sb_mount+0x35/0x40
[ 3345.812356][T20504]  security_sb_mount+0x87/0xd0
[ 3345.817145][T20504]  do_mount+0x1d4/0x1c00
[ 3345.821677][T20504]  ? copy_mount_string+0x40/0x40
[ 3345.826634][T20504]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3345.832887][T20504]  ? _copy_from_user+0x12c/0x1a0
[ 3345.837852][T20504]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3345.844110][T20504]  ? copy_mount_options+0x2db/0x3f0
[ 3345.849358][T20504]  ksys_mount+0xdb/0x150
[ 3345.853625][T20504]  __x64_sys_mount+0xbe/0x150
[ 3345.858321][T20504]  do_syscall_64+0xfd/0x680
[ 3345.862869][T20504]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3345.868777][T20504] RIP: 0033:0x459279
[ 3345.872695][T20504] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3345.892318][T20504] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3345.900753][T20504] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3345.908753][T20504] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3345.916756][T20504] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3345.924971][T20504] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3345.932960][T20504] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3345.942359][T20504] ERROR: Out of memory at tomoyo_realpath_from_path.
10:11:54 executing program 2 (fault-call:5 fault-nth:7):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3346.070208][T20623] FAULT_INJECTION: forcing a failure.
[ 3346.070208][T20623] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 3346.083467][T20623] CPU: 1 PID: 20623 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3346.092498][T20623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3346.102571][T20623] Call Trace:
[ 3346.105881][T20623]  dump_stack+0x172/0x1f0
[ 3346.111755][T20623]  should_fail.cold+0xa/0x15
[ 3346.116409][T20623]  ? tomoyo_mount_acl+0xe0/0x840
[ 3346.121384][T20623]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3346.127207][T20623]  ? do_syscall_64+0xfd/0x680
[ 3346.131895][T20623]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3346.137970][T20623]  ? kasan_check_read+0x11/0x20
[ 3346.142831][T20623]  should_fail_alloc_page+0x50/0x60
[ 3346.148036][T20623]  __alloc_pages_nodemask+0x1a1/0x8d0
[ 3346.153413][T20623]  ? kernel_text_address+0x73/0xf0
[ 3346.158533][T20623]  ? __alloc_pages_slowpath+0x28b0/0x28b0
[ 3346.164273][T20623]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3346.170091][T20623]  cache_grow_begin+0x9d/0x650
[ 3346.174866][T20623]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.181124][T20623]  __kmalloc+0x67a/0x740
[ 3346.185382][T20623]  ? tomoyo_realpath_from_path+0xcd/0x7a0
[ 3346.191110][T20623]  tomoyo_realpath_from_path+0xcd/0x7a0
[ 3346.196669][T20623]  tomoyo_mount_acl+0x149/0x840
[ 3346.201530][T20623]  ? kasan_check_write+0x14/0x20
[ 3346.206487][T20623]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3346.212034][T20623]  ? lock_downgrade+0x880/0x880
[ 3346.216924][T20623]  ? mark_held_locks+0xf0/0xf0
[ 3346.221712][T20623]  ? lock_acquire+0x16f/0x3f0
[ 3346.226394][T20623]  ? tomoyo_mount_permission+0x10a/0x410
[ 3346.232039][T20623]  tomoyo_mount_permission+0x16a/0x410
[ 3346.237520][T20623]  ? tomoyo_mount_permission+0x10a/0x410
[ 3346.243169][T20623]  ? tomoyo_mount_acl+0x840/0x840
[ 3346.248210][T20623]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.254467][T20623]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.260714][T20623]  ? strncpy_from_user+0x2b4/0x400
[ 3346.265836][T20623]  tomoyo_sb_mount+0x35/0x40
[ 3346.265857][T20623]  security_sb_mount+0x87/0xd0
[ 3346.265879][T20623]  do_mount+0x1d4/0x1c00
[ 3346.265901][T20623]  ? copy_mount_string+0x40/0x40
[ 3346.284402][T20623]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.290650][T20623]  ? _copy_from_user+0x12c/0x1a0
[ 3346.295603][T20623]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.301856][T20623]  ? copy_mount_options+0x2db/0x3f0
[ 3346.307063][T20623]  ksys_mount+0xdb/0x150
[ 3346.307084][T20623]  __x64_sys_mount+0xbe/0x150
[ 3346.307106][T20623]  do_syscall_64+0xfd/0x680
[ 3346.320506][T20623]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3346.326407][T20623] RIP: 0033:0x459279
[ 3346.330318][T20623] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3346.349928][T20623] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3346.358344][T20623] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3346.358354][T20623] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3346.358363][T20623] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3346.358372][T20623] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3346.358380][T20623] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:55 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:55 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:55 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(0x0, 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:55 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x40, 0x1c}, @null, @null, @netrom]}, 0x40)

10:11:55 executing program 2 (fault-call:5 fault-nth:8):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:55 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x60, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:55 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
setsockopt$netrom_NETROM_T1(r3, 0x103, 0x1, &(0x7f0000000340)=0x7, 0x4)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={<r4=>0xffffffffffffffff, r0, 0x0, 0x26, &(0x7f0000000040)='@ppp0em0\xc9\x02wlan0[bdev#vboxnet0security\x00'}, 0x30)
get_robust_list(r4, &(0x7f00000002c0)=&(0x7f0000000280)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)}}, &(0x7f0000000300)=0x18)
setsockopt$inet6_dccp_int(r3, 0x21, 0x1, &(0x7f0000000000)=0x8, 0x30a)

10:11:55 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x40, 0x200000c0}, @null, @null, @netrom]}, 0x40)

[ 3346.589235][T20634] validate_nla: 13 callbacks suppressed
[ 3346.589247][T20634] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3346.620701][T20635] FAULT_INJECTION: forcing a failure.
[ 3346.620701][T20635] name failslab, interval 1, probability 0, space 0, times 0
[ 3346.645283][T20635] CPU: 1 PID: 20635 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3346.654333][T20635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3346.664423][T20635] Call Trace:
[ 3346.667730][T20635]  dump_stack+0x172/0x1f0
[ 3346.672084][T20635]  should_fail.cold+0xa/0x15
[ 3346.676694][T20635]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3346.676717][T20635]  ? ___might_sleep+0x163/0x280
[ 3346.676741][T20635]  __should_failslab+0x121/0x190
[ 3346.692322][T20635]  should_failslab+0x9/0x14
[ 3346.696826][T20635]  __kmalloc+0x2d9/0x740
[ 3346.701074][T20635]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 3346.707316][T20635]  ? d_absolute_path+0x11b/0x170
[ 3346.707330][T20635]  ? __d_path+0x140/0x140
[ 3346.707347][T20635]  ? tomoyo_encode2.part.0+0xf5/0x400
[ 3346.707367][T20635]  tomoyo_encode2.part.0+0xf5/0x400
[ 3346.707392][T20635]  tomoyo_encode+0x2b/0x50
[ 3346.731649][T20635]  tomoyo_realpath_from_path+0x1d3/0x7a0
[ 3346.737328][T20635]  tomoyo_mount_acl+0x149/0x840
[ 3346.742355][T20635]  ? kasan_check_write+0x14/0x20
[ 3346.747313][T20635]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3346.752868][T20635]  ? lock_downgrade+0x880/0x880
[ 3346.757733][T20635]  ? mark_held_locks+0xf0/0xf0
[ 3346.762534][T20635]  ? lock_acquire+0x16f/0x3f0
[ 3346.767224][T20635]  ? tomoyo_mount_permission+0x10a/0x410
[ 3346.772877][T20635]  tomoyo_mount_permission+0x16a/0x410
[ 3346.778346][T20635]  ? tomoyo_mount_permission+0x10a/0x410
[ 3346.783986][T20635]  ? tomoyo_mount_acl+0x840/0x840
[ 3346.789020][T20635]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.795271][T20635]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.801510][T20635]  ? strncpy_from_user+0x2b4/0x400
[ 3346.801531][T20635]  tomoyo_sb_mount+0x35/0x40
[ 3346.801549][T20635]  security_sb_mount+0x87/0xd0
[ 3346.801571][T20635]  do_mount+0x1d4/0x1c00
[ 3346.801593][T20635]  ? copy_mount_string+0x40/0x40
[ 3346.816034][T20635]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.816051][T20635]  ? _copy_from_user+0x12c/0x1a0
[ 3346.816070][T20635]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3346.816091][T20635]  ? copy_mount_options+0x2db/0x3f0
[ 3346.831486][T20635]  ksys_mount+0xdb/0x150
[ 3346.831507][T20635]  __x64_sys_mount+0xbe/0x150
[ 3346.831528][T20635]  do_syscall_64+0xfd/0x680
[ 3346.831549][T20635]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3346.831561][T20635] RIP: 0033:0x459279
[ 3346.831576][T20635] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
10:11:55 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x68, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:55 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
socket$inet_udp(0x2, 0x2, 0x0)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3346.831584][T20635] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3346.847945][T20635] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3346.847954][T20635] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3346.847963][T20635] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3346.847972][T20635] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3346.847981][T20635] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3346.909697][T20635] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3346.960268][T20645] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:55 executing program 2 (fault-call:5 fault-nth:9):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:55 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000000)="e547f90a04a44cc3fa23352665048e76", 0x10)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3347.082157][T20642] device nr0
 entered promiscuous mode
[ 3347.089854][T20679] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3347.184197][T20755] FAULT_INJECTION: forcing a failure.
[ 3347.184197][T20755] name failslab, interval 1, probability 0, space 0, times 0
[ 3347.209970][T20755] CPU: 0 PID: 20755 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3347.219023][T20755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3347.229257][T20755] Call Trace:
[ 3347.232562][T20755]  dump_stack+0x172/0x1f0
[ 3347.236909][T20755]  should_fail.cold+0xa/0x15
[ 3347.241514][T20755]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3347.247336][T20755]  ? ___might_sleep+0x163/0x280
[ 3347.252199][T20755]  __should_failslab+0x121/0x190
[ 3347.257146][T20755]  should_failslab+0x9/0x14
[ 3347.261653][T20755]  kmem_cache_alloc+0x2af/0x6f0
[ 3347.266508][T20755]  ? tomoyo_realpath_from_path+0x1de/0x7a0
[ 3347.272325][T20755]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 3347.278584][T20755]  getname_kernel+0x53/0x370
[ 3347.283183][T20755]  kern_path+0x20/0x40
[ 3347.287260][T20755]  tomoyo_mount_acl+0x61d/0x840
[ 3347.292121][T20755]  ? kasan_check_write+0x14/0x20
[ 3347.297067][T20755]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3347.302613][T20755]  ? lock_downgrade+0x880/0x880
[ 3347.307471][T20755]  ? mark_held_locks+0xf0/0xf0
[ 3347.312269][T20755]  ? lock_acquire+0x16f/0x3f0
[ 3347.316958][T20755]  ? tomoyo_mount_permission+0x10a/0x410
[ 3347.322606][T20755]  tomoyo_mount_permission+0x16a/0x410
[ 3347.328067][T20755]  ? tomoyo_mount_permission+0x10a/0x410
[ 3347.333713][T20755]  ? tomoyo_mount_acl+0x840/0x840
[ 3347.338745][T20755]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.345091][T20755]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.351333][T20755]  ? strncpy_from_user+0x2b4/0x400
[ 3347.356579][T20755]  tomoyo_sb_mount+0x35/0x40
[ 3347.361189][T20755]  security_sb_mount+0x87/0xd0
[ 3347.365970][T20755]  do_mount+0x1d4/0x1c00
[ 3347.370258][T20755]  ? copy_mount_string+0x40/0x40
[ 3347.375207][T20755]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.381462][T20755]  ? _copy_from_user+0x12c/0x1a0
[ 3347.386413][T20755]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.392668][T20755]  ? copy_mount_options+0x2db/0x3f0
[ 3347.397881][T20755]  ksys_mount+0xdb/0x150
[ 3347.402138][T20755]  __x64_sys_mount+0xbe/0x150
[ 3347.406826][T20755]  do_syscall_64+0xfd/0x680
[ 3347.411336][T20755]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3347.417231][T20755] RIP: 0033:0x459279
[ 3347.421135][T20755] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3347.440751][T20755] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3347.449180][T20755] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3347.457160][T20755] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3347.465166][T20755] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3347.473146][T20755] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3347.481123][T20755] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:56 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:56 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x40, 0x40, 0x1c}, @null, @null, @netrom]}, 0x40)

10:11:56 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6c, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:56 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000000140)=r0, 0x4)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = getpgrp(0xffffffffffffffff)
syz_open_procfs(r3, &(0x7f0000000200)='net/igmp6\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$VIDIOC_TRY_DECODER_CMD(r2, 0xc0485661, &(0x7f0000000000)={0x7, 0x3, @stop_pts=0x2})

10:11:56 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(0x0, 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:56 executing program 2 (fault-call:5 fault-nth:10):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3347.631875][T20760] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3347.669380][T20763] FAULT_INJECTION: forcing a failure.
[ 3347.669380][T20763] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 3347.682642][T20763] CPU: 0 PID: 20763 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3347.691670][T20763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3347.701736][T20763] Call Trace:
[ 3347.705042][T20763]  dump_stack+0x172/0x1f0
[ 3347.709401][T20763]  should_fail.cold+0xa/0x15
[ 3347.714000][T20763]  ? __kasan_slab_free+0x102/0x150
[ 3347.719126][T20763]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3347.724958][T20763]  ? mark_held_locks+0xf0/0xf0
[ 3347.729746][T20763]  should_fail_alloc_page+0x50/0x60
[ 3347.734955][T20763]  __alloc_pages_nodemask+0x1a1/0x8d0
[ 3347.740335][T20763]  ? fs_reclaim_acquire.part.0+0x30/0x30
[ 3347.745999][T20763]  ? __alloc_pages_slowpath+0x28b0/0x28b0
[ 3347.751733][T20763]  ? fs_reclaim_acquire.part.0+0x30/0x30
[ 3347.757383][T20763]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3347.763210][T20763]  cache_grow_begin+0x9d/0x650
[ 3347.767986][T20763]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.774246][T20763]  kmem_cache_alloc+0x628/0x6f0
[ 3347.779114][T20763]  ? tomoyo_realpath_from_path+0x1de/0x7a0
[ 3347.784949][T20763]  getname_kernel+0x53/0x370
[ 3347.789584][T20763]  kern_path+0x20/0x40
[ 3347.793671][T20763]  tomoyo_mount_acl+0x61d/0x840
[ 3347.798539][T20763]  ? kasan_check_write+0x14/0x20
[ 3347.803485][T20763]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3347.809036][T20763]  ? lock_downgrade+0x880/0x880
[ 3347.813901][T20763]  ? mark_held_locks+0xf0/0xf0
[ 3347.818704][T20763]  ? lock_acquire+0x16f/0x3f0
[ 3347.823414][T20763]  ? tomoyo_mount_permission+0x10a/0x410
[ 3347.829068][T20763]  tomoyo_mount_permission+0x16a/0x410
[ 3347.834542][T20763]  ? tomoyo_mount_permission+0x10a/0x410
[ 3347.840188][T20763]  ? tomoyo_mount_acl+0x840/0x840
[ 3347.845219][T20763]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.851507][T20763]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.857761][T20763]  ? strncpy_from_user+0x2b4/0x400
[ 3347.862884][T20763]  tomoyo_sb_mount+0x35/0x40
[ 3347.867839][T20763]  security_sb_mount+0x87/0xd0
[ 3347.872620][T20763]  do_mount+0x1d4/0x1c00
[ 3347.876881][T20763]  ? copy_mount_string+0x40/0x40
[ 3347.881828][T20763]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.888075][T20763]  ? _copy_from_user+0x12c/0x1a0
[ 3347.893026][T20763]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3347.899282][T20763]  ? copy_mount_options+0x2db/0x3f0
[ 3347.904495][T20763]  ksys_mount+0xdb/0x150
[ 3347.908750][T20763]  __x64_sys_mount+0xbe/0x150
[ 3347.913449][T20763]  do_syscall_64+0xfd/0x680
[ 3347.917977][T20763]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3347.923886][T20763] RIP: 0033:0x459279
[ 3347.927790][T20763] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3347.947406][T20763] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3347.955837][T20763] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3347.963820][T20763] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3347.971799][T20763] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
10:11:56 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast={0xa2, 0xa6, 0xa8, 0x40, 0x40, 0x200000c0}, @null, @null, @netrom]}, 0x40)

10:11:56 executing program 0:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r0, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000000)=<r2=>0x0)
r3 = syz_open_procfs(r2, &(0x7f0000000240)='oom_adj\x00')
r4 = userfaultfd(0x0)
ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000080))
ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000300)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1})
get_mempolicy(0x0, 0x0, 0x0, &(0x7f0000548000/0x2000)=nil, 0x3)
ioctl$UFFDIO_UNREGISTER(r4, 0x8010aa01, &(0x7f0000000040)={&(0x7f00005ae000/0x1000)=nil, 0x1000})
splice(r3, 0x0, r1, 0x0, 0x8100000, 0x8)

10:11:56 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x74, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3347.979776][T20763] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3347.987753][T20763] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:56 executing program 2 (fault-call:5 fault-nth:11):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:56 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x1c}, @null, @netrom]}, 0x40)

[ 3348.171185][T20770] device nr0
 entered promiscuous mode
[ 3348.180820][T20781] FAULT_INJECTION: forcing a failure.
[ 3348.180820][T20781] name failslab, interval 1, probability 0, space 0, times 0
[ 3348.195526][T20780] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3348.204604][T20781] CPU: 0 PID: 20781 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3348.213659][T20781] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3348.223747][T20781] Call Trace:
[ 3348.227061][T20781]  dump_stack+0x172/0x1f0
[ 3348.231425][T20781]  should_fail.cold+0xa/0x15
[ 3348.236041][T20781]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3348.241872][T20781]  ? ___might_sleep+0x163/0x280
[ 3348.246756][T20781]  __should_failslab+0x121/0x190
[ 3348.251722][T20781]  should_failslab+0x9/0x14
[ 3348.256252][T20781]  __kmalloc+0x2d9/0x740
[ 3348.260517][T20781]  ? tomoyo_realpath_from_path+0xc0/0x7a0
[ 3348.266264][T20781]  ? rcu_read_lock_sched_held+0x110/0x130
[ 3348.272013][T20781]  ? tomoyo_realpath_from_path+0xcd/0x7a0
[ 3348.277797][T20781]  tomoyo_realpath_from_path+0xcd/0x7a0
[ 3348.283382][T20781]  tomoyo_mount_acl+0x65f/0x840
[ 3348.288276][T20781]  ? kasan_check_write+0x14/0x20
[ 3348.293239][T20781]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3348.298795][T20781]  ? lock_downgrade+0x880/0x880
[ 3348.303673][T20781]  ? mark_held_locks+0xf0/0xf0
[ 3348.308491][T20781]  ? lock_acquire+0x16f/0x3f0
[ 3348.313192][T20781]  ? tomoyo_mount_permission+0x10a/0x410
[ 3348.318864][T20781]  tomoyo_mount_permission+0x16a/0x410
[ 3348.324352][T20781]  ? tomoyo_mount_permission+0x10a/0x410
[ 3348.330006][T20781]  ? tomoyo_mount_acl+0x840/0x840
[ 3348.335064][T20781]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3348.341351][T20781]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3348.347603][T20781]  ? strncpy_from_user+0x2b4/0x400
[ 3348.352739][T20781]  tomoyo_sb_mount+0x35/0x40
[ 3348.357365][T20781]  security_sb_mount+0x87/0xd0
[ 3348.362158][T20781]  do_mount+0x1d4/0x1c00
[ 3348.366527][T20781]  ? copy_mount_string+0x40/0x40
[ 3348.371487][T20781]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3348.377737][T20781]  ? _copy_from_user+0x12c/0x1a0
[ 3348.382705][T20781]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3348.388975][T20781]  ? copy_mount_options+0x2db/0x3f0
[ 3348.394196][T20781]  ksys_mount+0xdb/0x150
[ 3348.398500][T20781]  __x64_sys_mount+0xbe/0x150
[ 3348.403199][T20781]  do_syscall_64+0xfd/0x680
[ 3348.407728][T20781]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3348.413632][T20781] RIP: 0033:0x459279
[ 3348.417541][T20781] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3348.437162][T20781] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3348.445605][T20781] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3348.453594][T20781] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3348.461590][T20781] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
10:11:57 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3348.469581][T20781] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3348.477568][T20781] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3348.495124][T20781] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3348.750762][T20783] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:57 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x200000c0}, @null, @netrom]}, 0x40)

10:11:57 executing program 2 (fault-call:5 fault-nth:12):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:57 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:57 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7a, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:57 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_TIOCINQ(r1, 0x541b, &(0x7f0000000140))
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000040)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$KDDELIO(r1, 0x4b35, 0x8184)
getsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000080)=0x5, &(0x7f0000000100)=0x4)
shmget(0x1, 0x4000, 0x18, &(0x7f0000ff9000/0x4000)=nil)
write$P9_RLERRORu(r1, &(0x7f0000000000)={0x15, 0x7, 0x2, {{0x8, 'oom_adj\x00'}, 0x9}}, 0x15)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:57 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x1c}, @null, @netrom]}, 0x40)

[ 3348.905879][T20792] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3348.931197][T20794] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:57 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:57 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$KVM_PPC_GET_PVINFO(r1, 0x4080aea1, &(0x7f0000000000)=""/59)

[ 3349.068443][T20790] FAULT_INJECTION: forcing a failure.
[ 3349.068443][T20790] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 3349.081719][T20790] CPU: 0 PID: 20790 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3349.091011][T20790] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3349.101086][T20790] Call Trace:
[ 3349.104403][T20790]  dump_stack+0x172/0x1f0
[ 3349.108780][T20790]  should_fail.cold+0xa/0x15
[ 3349.113403][T20790]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3349.119249][T20790]  should_fail_alloc_page+0x50/0x60
[ 3349.124471][T20790]  __alloc_pages_nodemask+0x1a1/0x8d0
[ 3349.129862][T20790]  ? rcu_read_lock_sched_held+0x110/0x130
[ 3349.135601][T20790]  ? kmem_cache_free+0x26b/0x320
[ 3349.140564][T20790]  ? __alloc_pages_slowpath+0x28b0/0x28b0
[ 3349.146299][T20790]  ? putname+0xf4/0x130
[ 3349.150477][T20790]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3349.156302][T20790]  cache_grow_begin+0x9d/0x650
[ 3349.161088][T20790]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.167354][T20790]  __kmalloc+0x67a/0x740
[ 3349.171871][T20790]  ? tomoyo_realpath_from_path+0xcd/0x7a0
[ 3349.177617][T20790]  tomoyo_realpath_from_path+0xcd/0x7a0
[ 3349.183195][T20790]  tomoyo_mount_acl+0x65f/0x840
[ 3349.188071][T20790]  ? kasan_check_write+0x14/0x20
[ 3349.193031][T20790]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3349.198589][T20790]  ? lock_downgrade+0x880/0x880
[ 3349.203460][T20790]  ? mark_held_locks+0xf0/0xf0
[ 3349.208262][T20790]  ? lock_acquire+0x16f/0x3f0
[ 3349.212949][T20790]  ? tomoyo_mount_permission+0x10a/0x410
[ 3349.218603][T20790]  tomoyo_mount_permission+0x16a/0x410
[ 3349.224073][T20790]  ? tomoyo_mount_permission+0x10a/0x410
[ 3349.229726][T20790]  ? tomoyo_mount_acl+0x840/0x840
[ 3349.234767][T20790]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.241041][T20790]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.247303][T20790]  ? strncpy_from_user+0x2b4/0x400
[ 3349.252427][T20790]  tomoyo_sb_mount+0x35/0x40
[ 3349.257027][T20790]  security_sb_mount+0x87/0xd0
[ 3349.261805][T20790]  do_mount+0x1d4/0x1c00
[ 3349.266071][T20790]  ? copy_mount_string+0x40/0x40
[ 3349.271018][T20790]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.277268][T20790]  ? _copy_from_user+0x12c/0x1a0
[ 3349.282216][T20790]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.288470][T20790]  ? copy_mount_options+0x2db/0x3f0
[ 3349.293685][T20790]  ksys_mount+0xdb/0x150
[ 3349.297953][T20790]  __x64_sys_mount+0xbe/0x150
[ 3349.302648][T20790]  do_syscall_64+0xfd/0x680
[ 3349.307176][T20790]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3349.313076][T20790] RIP: 0033:0x459279
[ 3349.317067][T20790] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3349.336686][T20790] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3349.345128][T20790] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3349.353146][T20790] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3349.361129][T20790] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
10:11:58 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x200000c0}, @null, @netrom]}, 0x40)

[ 3349.369111][T20790] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3349.377101][T20790] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3349.399280][T20795] device nr0
 entered promiscuous mode
10:11:58 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:58 executing program 2 (fault-call:5 fault-nth:13):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3349.429107][T20805] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:58 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000000)={0x1, 0x8000, 0x6, 0x75})

10:11:58 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x1c}, @null, @netrom]}, 0x40)

10:11:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x300, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3349.587212][T20815] FAULT_INJECTION: forcing a failure.
[ 3349.587212][T20815] name failslab, interval 1, probability 0, space 0, times 0
[ 3349.636375][T20815] CPU: 1 PID: 20815 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3349.645463][T20815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3349.655534][T20815] Call Trace:
[ 3349.658844][T20815]  dump_stack+0x172/0x1f0
[ 3349.663200][T20815]  should_fail.cold+0xa/0x15
[ 3349.667813][T20815]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3349.673643][T20815]  ? ___might_sleep+0x163/0x280
[ 3349.678515][T20815]  __should_failslab+0x121/0x190
[ 3349.683459][T20815]  should_failslab+0x9/0x14
[ 3349.687971][T20815]  __kmalloc+0x2d9/0x740
[ 3349.692228][T20815]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 3349.698497][T20815]  ? d_absolute_path+0x11b/0x170
[ 3349.703450][T20815]  ? __d_path+0x140/0x140
[ 3349.707788][T20815]  ? tomoyo_encode2.part.0+0xf5/0x400
[ 3349.713175][T20815]  tomoyo_encode2.part.0+0xf5/0x400
[ 3349.718400][T20815]  tomoyo_encode+0x2b/0x50
[ 3349.722831][T20815]  tomoyo_realpath_from_path+0x1d3/0x7a0
[ 3349.728485][T20815]  tomoyo_mount_acl+0x65f/0x840
[ 3349.733350][T20815]  ? kasan_check_write+0x14/0x20
[ 3349.738303][T20815]  ? tomoyo_check_mount_acl+0x1b0/0x1b0
[ 3349.743860][T20815]  ? lock_downgrade+0x880/0x880
[ 3349.748726][T20815]  ? mark_held_locks+0xf0/0xf0
[ 3349.753528][T20815]  ? lock_acquire+0x16f/0x3f0
[ 3349.758214][T20815]  ? tomoyo_mount_permission+0x10a/0x410
[ 3349.763859][T20815]  tomoyo_mount_permission+0x16a/0x410
[ 3349.769349][T20815]  ? tomoyo_mount_permission+0x10a/0x410
[ 3349.774998][T20815]  ? tomoyo_mount_acl+0x840/0x840
[ 3349.780031][T20815]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.786287][T20815]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.786303][T20815]  ? strncpy_from_user+0x2b4/0x400
[ 3349.786323][T20815]  tomoyo_sb_mount+0x35/0x40
[ 3349.786343][T20815]  security_sb_mount+0x87/0xd0
[ 3349.807048][T20815]  do_mount+0x1d4/0x1c00
[ 3349.811300][T20815]  ? copy_mount_string+0x40/0x40
[ 3349.811319][T20815]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.811335][T20815]  ? _copy_from_user+0x12c/0x1a0
[ 3349.811351][T20815]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3349.811366][T20815]  ? copy_mount_options+0x2db/0x3f0
[ 3349.811386][T20815]  ksys_mount+0xdb/0x150
[ 3349.811403][T20815]  __x64_sys_mount+0xbe/0x150
[ 3349.811422][T20815]  do_syscall_64+0xfd/0x680
[ 3349.811444][T20815]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3349.811456][T20815] RIP: 0033:0x459279
[ 3349.811472][T20815] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3349.811487][T20815] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3349.890113][T20815] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3349.898094][T20815] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3349.906077][T20815] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3349.914062][T20815] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3349.922076][T20815] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3349.930489][T20815] ERROR: Out of memory at tomoyo_realpath_from_path.
[ 3349.988025][T20820] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:11:58 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:58 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$SNDRV_TIMER_IOCTL_STOP(r0, 0x54a1)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:58 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x200000c0}, @null, @netrom]}, 0x40)

10:11:58 executing program 2 (fault-call:5 fault-nth:14):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x500, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:59 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x600, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:59 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000100)=0x3, 0xffffffffffffff72)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3350.192477][T20829] FAULT_INJECTION: forcing a failure.
[ 3350.192477][T20829] name failslab, interval 1, probability 0, space 0, times 0
[ 3350.235601][T20829] CPU: 1 PID: 20829 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3350.244684][T20829] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3350.254764][T20829] Call Trace:
[ 3350.258075][T20829]  dump_stack+0x172/0x1f0
[ 3350.262427][T20829]  should_fail.cold+0xa/0x15
[ 3350.267037][T20829]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3350.272873][T20829]  ? ___might_sleep+0x163/0x280
[ 3350.277739][T20829]  __should_failslab+0x121/0x190
[ 3350.282694][T20829]  should_failslab+0x9/0x14
[ 3350.287216][T20829]  kmem_cache_alloc+0x2af/0x6f0
[ 3350.292082][T20829]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 3350.298338][T20829]  ? security_capable+0x95/0xc0
[ 3350.303211][T20829]  getname_kernel+0x53/0x370
[ 3350.307816][T20829]  kern_path+0x20/0x40
[ 3350.311900][T20829]  do_mount+0xd0e/0x1c00
[ 3350.316164][T20829]  ? copy_mount_string+0x40/0x40
[ 3350.321126][T20829]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3350.327499][T20829]  ? _copy_from_user+0x12c/0x1a0
10:11:59 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:11:59 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x1c}, @null, @netrom]}, 0x40)

[ 3350.332453][T20829]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3350.338705][T20829]  ? copy_mount_options+0x2db/0x3f0
[ 3350.343914][T20829]  ksys_mount+0xdb/0x150
[ 3350.348172][T20829]  __x64_sys_mount+0xbe/0x150
[ 3350.352864][T20829]  do_syscall_64+0xfd/0x680
[ 3350.357386][T20829]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3350.363278][T20829] RIP: 0033:0x459279
[ 3350.364580][T20833] device nr0
 entered promiscuous mode
10:11:59 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r0)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f0000000100)=ANY=[@ANYBLOB="04009e824a13000004000000070000000000000000000000de9100001d000000000000000000000000000000000000000000000000000000060000000000000000000000000000000200c862efd290864aec000002000000000000000000000000000000000000000000000000000000010047790300000000000000000000000100000000000000060000000000000000000000000000000500000060000000080000000700000000000000000000001f00000000000100"/200])

[ 3350.367175][T20829] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3350.367184][T20829] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3350.367205][T20829] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3350.367214][T20829] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3350.367229][T20829] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3350.424582][T20829] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3350.433429][T20829] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:11:59 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x200000c0}, @null, @netrom]}, 0x40)

10:11:59 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
ioctl$DRM_IOCTL_MARK_BUFS(r0, 0x40206417, &(0x7f0000000040)={0x85, 0x9, 0x8, 0x4, 0xe, 0x8})
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:59 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:11:59 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x40, 0x1c}, @null, @netrom]}, 0x40)

10:11:59 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
write(r1, &(0x7f0000000100)="c3c53aa5419bbe093d37f1cdc911bac7384135ec774e2923d1751e469b578370d5fbee9baa0b2a57ce7688f406903c57aa57c9417a25d9ae025fe066160a551429bd053795c3fc0cae3d694b3bdeeb3394e27a234bc771e9e3cc20a1af918cb3c97d36e958de52c27603165dc11839fe29e8a226a0ab0ff0c843e39bf04a3f4d38f3d3b69b78cd5e3eb7b7a5a4a3f563328e57c94d2eb90495350f4a4cf3714f28db11c5ac3965890bd2", 0xaa)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:11:59 executing program 2 (fault-call:5 fault-nth:15):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:11:59 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x700, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:11:59 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x40, 0x200000c0}, @null, @netrom]}, 0x40)

10:11:59 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3351.133080][T20858] FAULT_INJECTION: forcing a failure.
[ 3351.133080][T20858] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 3351.146324][T20858] CPU: 1 PID: 20858 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3351.146334][T20858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3351.146341][T20858] Call Trace:
[ 3351.146365][T20858]  dump_stack+0x172/0x1f0
[ 3351.146390][T20858]  should_fail.cold+0xa/0x15
[ 3351.146415][T20858]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3351.146437][T20858]  ? mark_held_locks+0xf0/0xf0
[ 3351.146458][T20858]  should_fail_alloc_page+0x50/0x60
[ 3351.146482][T20858]  __alloc_pages_nodemask+0x1a1/0x8d0
[ 3351.198832][T20858]  ? fs_reclaim_acquire.part.0+0x30/0x30
[ 3351.204485][T20858]  ? __alloc_pages_slowpath+0x28b0/0x28b0
[ 3351.210226][T20858]  ? fs_reclaim_acquire.part.0+0x30/0x30
[ 3351.215864][T20858]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 3351.222119][T20858]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3351.222144][T20858]  cache_grow_begin+0x9d/0x650
[ 3351.222162][T20858]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3351.222179][T20858]  kmem_cache_alloc+0x628/0x6f0
[ 3351.222210][T20858]  getname_kernel+0x53/0x370
[ 3351.222228][T20858]  kern_path+0x20/0x40
[ 3351.222245][T20858]  do_mount+0xd0e/0x1c00
[ 3351.222267][T20858]  ? copy_mount_string+0x40/0x40
[ 3351.222282][T20858]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3351.222294][T20858]  ? _copy_from_user+0x12c/0x1a0
[ 3351.222320][T20858]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
10:12:00 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3351.243949][T20858]  ? copy_mount_options+0x2db/0x3f0
[ 3351.243972][T20858]  ksys_mount+0xdb/0x150
[ 3351.243991][T20858]  __x64_sys_mount+0xbe/0x150
[ 3351.244011][T20858]  do_syscall_64+0xfd/0x680
[ 3351.244034][T20858]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3351.279211][T20858] RIP: 0033:0x459279
[ 3351.279230][T20858] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
10:12:00 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x40, 0x40, 0x1c}, @null, @netrom]}, 0x40)

10:12:00 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000000)=0xffffffff80000001, 0xffffffffffffff79)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r0, 0x0, 0x80, 0x0)

[ 3351.279238][T20858] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3351.279253][T20858] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3351.279262][T20858] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3351.279269][T20858] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3351.279277][T20858] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3351.279285][T20858] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:00 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:00 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null={0x40, 0x40, 0x40, 0x40, 0x40, 0x200000c0}, @null, @netrom]}, 0x40)

[ 3351.645114][T20945] device nr0
 entered promiscuous mode
10:12:00 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:00 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={<r3=>0xffffffffffffffff}, 0x13f, 0x8}}, 0x20)
write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000140)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r3, r1}}, 0x18)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:00 executing program 2 (fault-call:5 fault-nth:16):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:00 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa3a, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:00 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, 0x0, &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:00 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x1c}, @netrom]}, 0x40)

[ 3352.071220][T20992] validate_nla: 9 callbacks suppressed
[ 3352.071230][T20992] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:00 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000200)=0x3, 0x1f6)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
r3 = add_key(&(0x7f0000000000)='cifs.spnego\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000100)="ef23fba9c3da4065b68772b587a68b70e089b126103332725b4231700ec5e6c61e37bf460dcaf2f9cee4f15d47f28134abab7f473bddda4282d35800f964c07394e7bebcea2aad7443d3323706625df2e875bb215cd44bb335b85714ec17a83b", 0x60, 0xffffffffffffffff)
r4 = add_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f00000001c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
keyctl$reject(0x13, r3, 0xca, 0x0, r4)
splice(r0, 0x0, r2, 0x0, 0x8100001, 0x0)

10:12:00 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x200000c0}, @netrom]}, 0x40)

10:12:00 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3352.120638][T20994] FAULT_INJECTION: forcing a failure.
[ 3352.120638][T20994] name failslab, interval 1, probability 0, space 0, times 0
[ 3352.180797][T20994] CPU: 1 PID: 20994 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3352.189897][T20994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3352.200005][T20994] Call Trace:
[ 3352.203315][T20994]  dump_stack+0x172/0x1f0
[ 3352.207658][T20994]  should_fail.cold+0xa/0x15
[ 3352.212261][T20994]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3352.218077][T20994]  ? ___might_sleep+0x163/0x280
[ 3352.218101][T20994]  __should_failslab+0x121/0x190
[ 3352.218117][T20994]  should_failslab+0x9/0x14
[ 3352.218135][T20994]  kmem_cache_alloc+0x2af/0x6f0
[ 3352.237439][T20994]  ? mark_held_locks+0xf0/0xf0
[ 3352.242219][T20994]  ? find_held_lock+0x35/0x130
[ 3352.247130][T20994]  ? get_mountpoint+0xb0/0x3d0
[ 3352.251907][T20994]  alloc_vfsmnt+0x28/0x780
[ 3352.256342][T20994]  clone_mnt+0x71/0xfe0
[ 3352.260517][T20994]  copy_tree+0xf8/0x940
[ 3352.264688][T20994]  ? rcu_read_lock_sched_held+0x110/0x130
[ 3352.270415][T20994]  ? kfree+0x26e/0x2a0
[ 3352.274493][T20994]  ? get_mountpoint+0xc7/0x3d0
[ 3352.279266][T20994]  __do_loopback.isra.0+0x177/0x3b0
[ 3352.284480][T20994]  do_mount+0x163c/0x1c00
[ 3352.288826][T20994]  ? copy_mount_string+0x40/0x40
[ 3352.293787][T20994]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3352.300041][T20994]  ? _copy_from_user+0x12c/0x1a0
[ 3352.304993][T20994]  ? copy_mount_options+0x2db/0x3f0
[ 3352.310208][T20994]  ksys_mount+0xdb/0x150
[ 3352.314468][T20994]  __x64_sys_mount+0xbe/0x150
[ 3352.319186][T20994]  do_syscall_64+0xfd/0x680
[ 3352.323719][T20994]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
10:12:01 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x1c}, @netrom]}, 0x40)

[ 3352.330509][T20994] RIP: 0033:0x459279
[ 3352.334411][T20994] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3352.354029][T20994] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3352.354043][T20994] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3352.354050][T20994] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:12:01 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:01 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
io_setup(0x100000001, &(0x7f0000000000)=<r2=>0x0)
io_getevents(r2, 0x4, 0x4, &(0x7f0000000100)=[{}, {}, {}, {}], &(0x7f0000000040))
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r3, 0x0, 0x8100000, 0x0)

[ 3352.354057][T20994] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3352.354065][T20994] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3352.354073][T20994] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3352.380986][T20996] device nr0
 entered promiscuous mode
[ 3352.433864][T20997] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:01 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:01 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x200000c0}, @netrom]}, 0x40)

10:12:01 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xe00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:01 executing program 2 (fault-call:5 fault-nth:17):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:01 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x0, 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:01 executing program 0:
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000640)='/dev/btrfs-control\x00', 0x2, 0x0)
ioctl$sock_ax25_SIOCDELRT(r0, 0x890c, &(0x7f0000000680)={@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]})
pipe(&(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
connect$inet6(r2, &(0x7f00000005c0)={0xa, 0x4e23, 0xffffffffffffff09, @mcast2, 0x57e72e18}, 0x1c)
r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r4, 0x518, 0x70bd26, 0x5, {}, ["", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x8040}, 0x4000000)
r5 = syz_open_dev$dri(&(0x7f00000001c0)='/dev/dri/card#\x00', 0x0, 0x200000)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f00000000c0)=0xe8)
bpf$MAP_CREATE(0x0, &(0x7f0000000340)={0xe, 0x6, 0x85, 0x3, 0x0, r1, 0xce8, [], r6, r1, 0x4, 0x1}, 0x3c)
ioctl$SIOCX25SCALLUSERDATA(r2, 0x89e5, &(0x7f0000000280)={0xc, "340f4940d3a5465fef1ea9931b273bea78b5e41525edc320f1c06ccdfafb36b871c76c52a1cc8f44babacf75fd9e05b93a452124e95a9aa4b4ff6af25746b286a4ca4bed60c568bbc53765b40167b973fe2cc4484e388da0c2d362c5753aec313b008741b455269b58ba55a88b413ee906ffa839896daa29674e9777111341a7"})
write$cgroup_int(r2, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r7 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
socket$inet6(0xa, 0x6, 0x6e9)
ioctl$KDSIGACCEPT(r7, 0x4b4e, 0x20)
write$rfkill(r7, &(0x7f0000000600)={0x200, 0x4, 0x1, 0x0, 0x1}, 0x8)
splice(r1, 0x0, r3, 0x0, 0x8100000, 0x0)
write$FUSE_NOTIFY_POLL(r1, &(0x7f0000000200)={0x18, 0x1, 0x0, {0x4}}, 0x18)
ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000003c0)={0x8001, 0xc6, 0x7, 0x0, 0x0, [{r5, 0x0, 0x1}, {r5, 0x0, 0x1}, {r3, 0x0, 0x4}, {r3, 0x0, 0x6}, {r5, 0x0, 0xfffffffffffffff9}, {r1, 0x0, 0x7fff}, {r1, 0x0, 0x9}]})

10:12:01 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x1c}, @netrom]}, 0x40)

[ 3352.976072][T21025] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3352.997064][T21024] FAULT_INJECTION: forcing a failure.
[ 3352.997064][T21024] name failslab, interval 1, probability 0, space 0, times 0
10:12:01 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000000)=0x9)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3353.066854][T21024] CPU: 1 PID: 21024 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3353.075943][T21024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3353.086018][T21024] Call Trace:
[ 3353.089336][T21024]  dump_stack+0x172/0x1f0
[ 3353.093698][T21024]  should_fail.cold+0xa/0x15
[ 3353.098313][T21024]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3353.104146][T21024]  ? ___might_sleep+0x163/0x280
[ 3353.109538][T21024]  __should_failslab+0x121/0x190
[ 3353.114491][T21024]  should_failslab+0x9/0x14
[ 3353.119010][T21024]  __kmalloc_track_caller+0x2d5/0x740
[ 3353.124393][T21024]  ? alloc_vfsmnt+0x28/0x780
[ 3353.129015][T21024]  ? kstrdup_const+0x66/0x80
[ 3353.133622][T21024]  kstrdup+0x3a/0x70
[ 3353.137533][T21024]  kstrdup_const+0x66/0x80
[ 3353.141974][T21024]  alloc_vfsmnt+0xba/0x780
[ 3353.146401][T21024]  clone_mnt+0x71/0xfe0
[ 3353.150577][T21024]  copy_tree+0xf8/0x940
[ 3353.154747][T21024]  ? rcu_read_lock_sched_held+0x110/0x130
[ 3353.160471][T21024]  ? kfree+0x26e/0x2a0
[ 3353.164552][T21024]  ? get_mountpoint+0xc7/0x3d0
[ 3353.169324][T21024]  __do_loopback.isra.0+0x177/0x3b0
[ 3353.174539][T21024]  do_mount+0x163c/0x1c00
[ 3353.178890][T21024]  ? copy_mount_string+0x40/0x40
[ 3353.183850][T21024]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3353.184947][T21029] device nr0
 entered promiscuous mode
[ 3353.190113][T21024]  ? _copy_from_user+0x12c/0x1a0
[ 3353.190136][T21024]  ? copy_mount_options+0x2db/0x3f0
[ 3353.190155][T21024]  ksys_mount+0xdb/0x150
[ 3353.190173][T21024]  __x64_sys_mount+0xbe/0x150
10:12:02 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x200000c0}, @netrom]}, 0x40)

10:12:02 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, 0x0)

[ 3353.190193][T21024]  do_syscall_64+0xfd/0x680
[ 3353.190221][T21024]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3353.190234][T21024] RIP: 0033:0x459279
[ 3353.190250][T21024] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3353.190258][T21024] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3353.205826][T21030] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:02 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f0000000000)={0x0, {0x0, 0x7}})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f0000000100)={0x1, 0x70, 0xff, 0x47baab05, 0x7, 0x5, 0x0, 0x80, 0x40, 0x0, 0x20, 0xffffffff, 0x6, 0xff, 0x6811, 0x3, 0x2dcf, 0x7, 0xeced, 0x101, 0x2, 0x4, 0x632, 0x9, 0x81, 0x8, 0x7ff, 0x3, 0xfb, 0x6d, 0x9, 0x1b80000000000000, 0x200, 0x7, 0x4, 0x401, 0x3ff, 0x2, 0x0, 0x6, 0x4, @perf_bp={&(0x7f0000000040)}, 0x18000, 0x16ec, 0x77a, 0x7, 0xfc00000000000, 0x6ff, 0x80000001})

[ 3353.205886][T21024] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3353.257111][T21024] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3353.257120][T21024] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3353.257129][T21024] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3353.257137][T21024] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3353.633307][T21040] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3353.650065][T21045] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:02 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:02 executing program 2 (fault-call:5 fault-nth:18):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:02 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x1c}, @netrom]}, 0x40)

10:12:02 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, 0x0)

10:12:02 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
ioctl$KVM_X86_SET_MCE(r0, 0x4040ae9e, &(0x7f0000000040)={0x3000000000000000, 0x6ea181cdb25d1af0, 0x7, 0xa, 0xc})
write$cgroup_int(r1, &(0x7f0000000000)=0xffffffff80000001, 0xf)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x2000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3353.801956][T21053] FAULT_INJECTION: forcing a failure.
[ 3353.801956][T21053] name failslab, interval 1, probability 0, space 0, times 0
[ 3353.817038][T21056] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3353.827009][T21053] CPU: 1 PID: 21053 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3353.836135][T21053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3353.846203][T21053] Call Trace:
[ 3353.849509][T21053]  dump_stack+0x172/0x1f0
[ 3353.853854][T21053]  should_fail.cold+0xa/0x15
[ 3353.858452][T21053]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3353.864268][T21053]  ? ___might_sleep+0x163/0x280
[ 3353.869150][T21053]  __should_failslab+0x121/0x190
[ 3353.874090][T21053]  should_failslab+0x9/0x14
[ 3353.878615][T21053]  kmem_cache_alloc+0x2af/0x6f0
[ 3353.883485][T21053]  alloc_vfsmnt+0x28/0x780
[ 3353.887908][T21053]  ? kasan_check_read+0x11/0x20
[ 3353.892776][T21053]  clone_mnt+0x71/0xfe0
10:12:02 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r1, 0x40405515, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x4f, 'syz1\x00', 0x40})
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
setsockopt$inet_int(r0, 0x0, 0x5, &(0x7f0000000100)=0x3, 0x4)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000140)={0x2, 'bond_slave_0\x00', 0x3}, 0x18)
setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x3ac, 0x5, 0x1, 0x6, 0x2, 0x4, 0x2, 0x2, 0x7ff, 0x6, 0x9}, 0xb)

10:12:02 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x200000c0}, @netrom]}, 0x40)

10:12:02 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, 0x0)

[ 3353.892793][T21053]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3353.892808][T21053]  ? is_subdir+0x28d/0x400
[ 3353.892829][T21053]  copy_tree+0x3ad/0x940
[ 3353.907123][T21053]  __do_loopback.isra.0+0x177/0x3b0
[ 3353.907144][T21053]  do_mount+0x163c/0x1c00
[ 3353.920899][T21053]  ? copy_mount_string+0x40/0x40
[ 3353.925849][T21053]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3353.932119][T21053]  ? _copy_from_user+0x12c/0x1a0
[ 3353.937078][T21053]  ? copy_mount_options+0x2db/0x3f0
[ 3353.942291][T21053]  ksys_mount+0xdb/0x150
[ 3353.946543][T21053]  __x64_sys_mount+0xbe/0x150
[ 3353.951234][T21053]  do_syscall_64+0xfd/0x680
[ 3353.951256][T21053]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3353.951267][T21053] RIP: 0033:0x459279
[ 3353.951284][T21053] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3353.951292][T21053] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3353.951306][T21053] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
10:12:02 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x40, 0x1c}, @netrom]}, 0x40)

10:12:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x3a0a, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:02 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r1}})

[ 3353.951315][T21053] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3353.951322][T21053] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3353.951331][T21053] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3353.951339][T21053] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3353.971280][T21062] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3354.180714][T21145] 9pnet: Insufficient options for proto=fd
[ 3354.258255][T21060] device nr0
 entered promiscuous mode
[ 3354.268589][T21132] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3354.562346][T21174] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:03 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:03 executing program 2 (fault-call:5 fault-nth:19):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:03 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x40, 0x200000c0}, @netrom]}, 0x40)

10:12:03 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
socket$inet6(0xa, 0x80002, 0xfe)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040))
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={<r3=>0x0, 0x5f}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000180)={r3, @in={{0x2, 0x4e21, @empty}}}, 0x84)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
r4 = gettid()
ptrace$peek(0x2, r4, &(0x7f0000000000))

10:12:03 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:03 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:03 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x40, 0x40, 0x1c}, @netrom]}, 0x40)

10:12:03 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4800, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3354.715592][T21185] 9pnet: Insufficient options for proto=fd
[ 3354.730122][T21183] FAULT_INJECTION: forcing a failure.
[ 3354.730122][T21183] name failslab, interval 1, probability 0, space 0, times 0
[ 3354.767118][T21183] CPU: 1 PID: 21183 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3354.776209][T21183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3354.786286][T21183] Call Trace:
[ 3354.789596][T21183]  dump_stack+0x172/0x1f0
[ 3354.793948][T21183]  should_fail.cold+0xa/0x15
[ 3354.798555][T21183]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3354.804385][T21183]  ? ___might_sleep+0x163/0x280
[ 3354.809256][T21183]  __should_failslab+0x121/0x190
[ 3354.814212][T21183]  should_failslab+0x9/0x14
[ 3354.818732][T21183]  __kmalloc_track_caller+0x2d5/0x740
[ 3354.824118][T21183]  ? alloc_vfsmnt+0x28/0x780
[ 3354.828739][T21183]  ? kstrdup_const+0x66/0x80
[ 3354.833344][T21183]  kstrdup+0x3a/0x70
[ 3354.837251][T21183]  kstrdup_const+0x66/0x80
[ 3354.841673][T21183]  alloc_vfsmnt+0xba/0x780
[ 3354.846095][T21183]  ? kasan_check_read+0x11/0x20
[ 3354.850951][T21183]  clone_mnt+0x71/0xfe0
[ 3354.855110][T21183]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3354.860843][T21183]  ? is_subdir+0x28d/0x400
[ 3354.865274][T21183]  copy_tree+0x3ad/0x940
[ 3354.869536][T21183]  __do_loopback.isra.0+0x177/0x3b0
[ 3354.874766][T21183]  do_mount+0x163c/0x1c00
[ 3354.879109][T21183]  ? copy_mount_string+0x40/0x40
[ 3354.884055][T21183]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3354.890314][T21183]  ? _copy_from_user+0x12c/0x1a0
[ 3354.895274][T21183]  ? copy_mount_options+0x2db/0x3f0
[ 3354.900488][T21183]  ksys_mount+0xdb/0x150
[ 3354.904748][T21183]  __x64_sys_mount+0xbe/0x150
[ 3354.909447][T21183]  do_syscall_64+0xfd/0x680
[ 3354.913966][T21183]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3354.919866][T21183] RIP: 0033:0x459279
[ 3354.923764][T21183] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3354.943381][T21183] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3354.951813][T21183] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3354.959795][T21183] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:12:03 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000000)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:03 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r1}})

10:12:03 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null={0x40, 0x40, 0x40, 0x40, 0x40, 0x200000c0}, @netrom]}, 0x40)

[ 3354.967767][T21183] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3354.975742][T21183] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3354.975751][T21183] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:03 executing program 2 (fault-call:5 fault-nth:20):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3355.056747][T21296] 9pnet: Insufficient options for proto=fd
[ 3355.152170][T21190] device nr0
 entered promiscuous mode
[ 3355.195592][T21306] FAULT_INJECTION: forcing a failure.
[ 3355.195592][T21306] name failslab, interval 1, probability 0, space 0, times 0
[ 3355.219750][T21306] CPU: 0 PID: 21306 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3355.228811][T21306] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3355.228819][T21306] Call Trace:
[ 3355.228842][T21306]  dump_stack+0x172/0x1f0
[ 3355.228876][T21306]  should_fail.cold+0xa/0x15
[ 3355.251155][T21306]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3355.256971][T21306]  ? ___might_sleep+0x163/0x280
[ 3355.261842][T21306]  __should_failslab+0x121/0x190
[ 3355.266794][T21306]  should_failslab+0x9/0x14
[ 3355.271306][T21306]  __kmalloc_track_caller+0x2d5/0x740
[ 3355.276689][T21306]  ? alloc_vfsmnt+0x28/0x780
[ 3355.281302][T21306]  ? kstrdup_const+0x66/0x80
[ 3355.285905][T21306]  kstrdup+0x3a/0x70
[ 3355.289808][T21306]  kstrdup_const+0x66/0x80
[ 3355.294235][T21306]  alloc_vfsmnt+0xba/0x780
[ 3355.298662][T21306]  ? kasan_check_read+0x11/0x20
[ 3355.303792][T21306]  clone_mnt+0x71/0xfe0
[ 3355.307957][T21306]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3355.313686][T21306]  ? is_subdir+0x28d/0x400
[ 3355.318121][T21306]  copy_tree+0x3ad/0x940
[ 3355.322385][T21306]  __do_loopback.isra.0+0x177/0x3b0
[ 3355.327592][T21306]  do_mount+0x163c/0x1c00
[ 3355.331968][T21306]  ? copy_mount_string+0x40/0x40
[ 3355.336924][T21306]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3355.343173][T21306]  ? _copy_from_user+0x12c/0x1a0
[ 3355.348125][T21306]  ? copy_mount_options+0x2db/0x3f0
[ 3355.353337][T21306]  ksys_mount+0xdb/0x150
[ 3355.357590][T21306]  __x64_sys_mount+0xbe/0x150
[ 3355.362284][T21306]  do_syscall_64+0xfd/0x680
[ 3355.366797][T21306]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3355.372694][T21306] RIP: 0033:0x459279
[ 3355.376606][T21306] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3355.396224][T21306] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3355.404660][T21306] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3355.412652][T21306] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3355.420626][T21306] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3355.428599][T21306] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3355.436576][T21306] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:04 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:04 executing program 0:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000000), &(0x7f00000000c0)=0x8)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000100)=@assoc_value={<r4=>0x0, 0x20}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000180)={r4, 0x7fffffff}, 0x8)

10:12:04 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x1c)

10:12:04 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

10:12:04 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4c00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:04 executing program 2 (fault-call:5 fault-nth:21):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:04 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000040)={r0, &(0x7f0000000000)="53eb75e89dcb5b8d68a2bec13365adced48e4ff67895ecc9", &(0x7f0000000100)=""/115}, 0x18)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
clock_gettime(0x0, &(0x7f0000000180)={<r4=>0x0, <r5=>0x0})
ioctl$VIDIOC_QUERYBUF(r3, 0xc0585609, &(0x7f00000001c0)={0x9, 0x0, 0x4, 0x40000, {r4, r5/1000+30000}, {0x5, 0xa, 0x0, 0x5, 0x1, 0xfffffffffffffff7, "c468d979"}, 0x5, 0x1, @offset=0x7, 0x4})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:04 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x200000c0)

10:12:04 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3355.684871][T21319] 9pnet: Insufficient options for proto=fd
[ 3355.712042][T21318] FAULT_INJECTION: forcing a failure.
[ 3355.712042][T21318] name failslab, interval 1, probability 0, space 0, times 0
[ 3355.762028][T21318] CPU: 0 PID: 21318 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3355.771103][T21318] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3355.781170][T21318] Call Trace:
[ 3355.784477][T21318]  dump_stack+0x172/0x1f0
[ 3355.788823][T21318]  should_fail.cold+0xa/0x15
[ 3355.793433][T21318]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3355.799259][T21318]  ? ___might_sleep+0x163/0x280
[ 3355.804129][T21318]  __should_failslab+0x121/0x190
10:12:04 executing program 3:
setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'trusted.', '.eth0/-@)}\x00'}, &(0x7f00000000c0)='&vboxnet0{,{nodevmime_type\x00', 0x1b, 0x0)
connect$rose(0xffffffffffffffff, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3355.809085][T21318]  should_failslab+0x9/0x14
[ 3355.813600][T21318]  __kmalloc_track_caller+0x2d5/0x740
[ 3355.818985][T21318]  ? alloc_vfsmnt+0x28/0x780
[ 3355.823586][T21318]  ? kstrdup_const+0x66/0x80
[ 3355.828187][T21318]  kstrdup+0x3a/0x70
[ 3355.832103][T21318]  kstrdup_const+0x66/0x80
[ 3355.836524][T21318]  alloc_vfsmnt+0xba/0x780
[ 3355.840948][T21318]  clone_mnt+0x71/0xfe0
[ 3355.845111][T21318]  ? kasan_check_read+0x11/0x20
[ 3355.849970][T21318]  ? do_raw_spin_unlock+0x57/0x270
[ 3355.853890][T21321] device nr0
 entered promiscuous mode
10:12:04 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

10:12:04 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x400000)
setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='teql0\x00', 0x10)

[ 3355.855094][T21318]  copy_tree+0x3ad/0x940
[ 3355.855124][T21318]  __do_loopback.isra.0+0x177/0x3b0
[ 3355.855144][T21318]  do_mount+0x163c/0x1c00
[ 3355.855172][T21318]  ? copy_mount_string+0x40/0x40
[ 3355.879340][T21318]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3355.885604][T21318]  ? _copy_from_user+0x12c/0x1a0
[ 3355.890563][T21318]  ? copy_mount_options+0x2db/0x3f0
[ 3355.895780][T21318]  ksys_mount+0xdb/0x150
[ 3355.900031][T21318]  __x64_sys_mount+0xbe/0x150
[ 3355.904727][T21318]  do_syscall_64+0xfd/0x680
[ 3355.909252][T21318]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3355.915233][T21318] RIP: 0033:0x459279
[ 3355.919139][T21318] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3355.938761][T21318] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3355.938777][T21318] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3355.938784][T21318] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3355.938790][T21318] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3355.938798][T21318] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3355.938805][T21318] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3356.080351][T21410] 9pnet: Insufficient options for proto=fd
10:12:05 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:05 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6800, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:05 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$KDDELIO(r0, 0x4b35, 0x5)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:05 executing program 2 (fault-call:5 fault-nth:22):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:05 executing program 3:
r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpu.stat\x00', 0x0, 0x0)
ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f0000000040)=0x7)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:05 executing program 4:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno'}})

[ 3356.427691][T21446] 9pnet: Insufficient options for proto=fd
10:12:05 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
write$P9_RXATTRWALK(r0, &(0x7f0000000000)={0xf, 0x1f, 0x2, 0x9}, 0xf)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:05 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6c00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3356.477811][T21444] FAULT_INJECTION: forcing a failure.
[ 3356.477811][T21444] name failslab, interval 1, probability 0, space 0, times 0
[ 3356.538815][T21444] CPU: 0 PID: 21444 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3356.547892][T21444] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3356.557968][T21444] Call Trace:
[ 3356.561275][T21444]  dump_stack+0x172/0x1f0
[ 3356.565628][T21444]  should_fail.cold+0xa/0x15
[ 3356.570238][T21444]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3356.576069][T21444]  ? ___might_sleep+0x163/0x280
[ 3356.580938][T21444]  __should_failslab+0x121/0x190
10:12:05 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(r3, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="83658154b5b9b620d654eb0000000000000000", @ANYRES16=r4, @ANYBLOB="000225bd7000fcdbdf250e000000600004000c00010073797a310000000044000700080002000400000008000200fbffffff080001001c0000000800040007000000080003000002000008000200ff7f0000080002000700000008000400020000000c0007000800010019000000"], 0x74}}, 0x20000000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3356.585882][T21444]  should_failslab+0x9/0x14
[ 3356.590397][T21444]  __kmalloc_track_caller+0x2d5/0x740
[ 3356.595785][T21444]  ? alloc_vfsmnt+0x28/0x780
[ 3356.600388][T21444]  ? kstrdup_const+0x66/0x80
[ 3356.604996][T21444]  kstrdup+0x3a/0x70
[ 3356.608907][T21444]  kstrdup_const+0x66/0x80
[ 3356.613333][T21444]  alloc_vfsmnt+0xba/0x780
[ 3356.613347][T21444]  ? kasan_check_read+0x11/0x20
[ 3356.613371][T21444]  clone_mnt+0x71/0xfe0
[ 3356.626790][T21444]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3356.632515][T21444]  ? is_subdir+0x28d/0x400
[ 3356.632536][T21444]  copy_tree+0x3ad/0x940
[ 3356.632562][T21444]  __do_loopback.isra.0+0x177/0x3b0
[ 3356.632580][T21444]  do_mount+0x163c/0x1c00
[ 3356.632601][T21444]  ? copy_mount_string+0x40/0x40
[ 3356.632623][T21444]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3356.661951][T21444]  ? _copy_from_user+0x12c/0x1a0
[ 3356.661975][T21444]  ? copy_mount_options+0x2db/0x3f0
[ 3356.661994][T21444]  ksys_mount+0xdb/0x150
[ 3356.662012][T21444]  __x64_sys_mount+0xbe/0x150
[ 3356.662033][T21444]  do_syscall_64+0xfd/0x680
10:12:05 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$usb(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x3, 0x200000)
accept$alg(r1, 0x0, 0x0)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400, 0x0)
getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f00000000c0)={'filter\x00', 0x71, "8df4cc45aad80525b52f8f6df767e86e025a234887b9acde5d6e33f609f3f2fc4449e102ff1c1a608e6f98c9b32be2a9b84a1dee0e984403d148333e9d7091a1e808e1a34b4bbf2c277b43ba9fdad6f8a58adb1ac6bb8d4d7b7a9c5ff181a34159a04fd1b7754ba515a906fe07a504833a"}, &(0x7f0000000040)=0x95)

[ 3356.662055][T21444]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3356.681074][T21444] RIP: 0033:0x459279
[ 3356.681091][T21444] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3356.681100][T21444] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3356.681115][T21444] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3356.681123][T21444] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:12:05 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3356.681131][T21444] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3356.681139][T21444] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3356.681147][T21444] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:05 executing program 2 (fault-call:5 fault-nth:23):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3356.871329][T21555] device nr0
 entered promiscuous mode
[ 3356.967877][T21652] FAULT_INJECTION: forcing a failure.
[ 3356.967877][T21652] name failslab, interval 1, probability 0, space 0, times 0
[ 3357.007899][T21652] CPU: 1 PID: 21652 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3357.016984][T21652] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3357.035827][T21652] Call Trace:
[ 3357.039137][T21652]  dump_stack+0x172/0x1f0
[ 3357.043484][T21652]  should_fail.cold+0xa/0x15
[ 3357.048090][T21652]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3357.053920][T21652]  ? ___might_sleep+0x163/0x280
[ 3357.058793][T21652]  __should_failslab+0x121/0x190
[ 3357.063739][T21652]  should_failslab+0x9/0x14
[ 3357.068252][T21652]  __kmalloc_track_caller+0x2d5/0x740
[ 3357.073634][T21652]  ? alloc_vfsmnt+0x28/0x780
[ 3357.078247][T21652]  ? kstrdup_const+0x66/0x80
[ 3357.082853][T21652]  kstrdup+0x3a/0x70
[ 3357.086772][T21652]  kstrdup_const+0x66/0x80
[ 3357.091197][T21652]  alloc_vfsmnt+0xba/0x780
[ 3357.095627][T21652]  ? kasan_check_read+0x11/0x20
[ 3357.100493][T21652]  clone_mnt+0x71/0xfe0
[ 3357.104656][T21652]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3357.110390][T21652]  ? is_subdir+0x28d/0x400
[ 3357.114853][T21652]  copy_tree+0x3ad/0x940
[ 3357.119127][T21652]  __do_loopback.isra.0+0x177/0x3b0
[ 3357.124372][T21652]  do_mount+0x163c/0x1c00
[ 3357.128728][T21652]  ? copy_mount_string+0x40/0x40
[ 3357.133694][T21652]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3357.139951][T21652]  ? _copy_from_user+0x12c/0x1a0
[ 3357.144903][T21652]  ? copy_mount_options+0x2db/0x3f0
[ 3357.150116][T21652]  ksys_mount+0xdb/0x150
[ 3357.154369][T21652]  __x64_sys_mount+0xbe/0x150
[ 3357.159059][T21652]  do_syscall_64+0xfd/0x680
[ 3357.163579][T21652]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3357.169504][T21652] RIP: 0033:0x459279
[ 3357.173408][T21652] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3357.193022][T21652] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3357.201454][T21652] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3357.209443][T21652] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3357.217432][T21652] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3357.225418][T21652] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3357.233401][T21652] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3357.246938][T21567] device nr0
 entered promiscuous mode
10:12:06 executing program 5:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:06 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7400, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:06 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000200)=0xffffffff7ffffffd, 0x86)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r3, 0xc008551c, &(0x7f0000000280)=ANY=[@ANYBLOB="080000001c00000006000000b74900000100000094dcdb53170000000000000005000000f5f7f6e3b7ad6bbb2e4c1bb6a75b82ff63a343d34e3905015b12c52648fc62f90bc8fad7f9ac302b21924f471ce78ba76c54"])
r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00')
sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4600}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x24, r4, 0x100, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x2}}, ["", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40001}, 0x20000000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:06 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x10000, 0x80000)
ioctl$SIOCAX25DELFWD(r1, 0x89eb, &(0x7f0000000040)={@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}})

10:12:06 executing program 2 (fault-call:5 fault-nth:24):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:06 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3357.786538][T21775] validate_nla: 11 callbacks suppressed
[ 3357.786547][T21775] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3357.817561][T21777] FAULT_INJECTION: forcing a failure.
[ 3357.817561][T21777] name failslab, interval 1, probability 0, space 0, times 0
10:12:06 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000001c0)=<r2=>0x0)
fcntl$getownex(r1, 0x10, &(0x7f0000000200)={0x0, <r3=>0x0})
kcmp(r2, r3, 0x3, r0, r1)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
close(r4)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480)={0x0, <r5=>0x0}, &(0x7f00000004c0)=0xc)
lstat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
stat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, <r7=>0x0})
getgroups(0xa, &(0x7f0000000680)=[0xffffffffffffffff, 0xee01, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xee01, 0xee00, 0x0, <r8=>0xffffffffffffffff])
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000006c0)={0x0, <r9=>0x0}, &(0x7f0000000700)=0xc)
stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000800)={{{@in6=@ipv4={[], [], @empty}, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000900)=0xe8)
stat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0})
sendmmsg$unix(r0, &(0x7f0000000ac0)=[{&(0x7f0000000280)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000300)="7a18a5c92b71bf8c426f0d23f157840358f57802324f41e346a4e969f3e3dca13a61e809ec0a983f8a1f6794804038deb62dbce198da69186bb03b02e112137480a90448d670883f91456363ff6f8c49f5de8fafc6aefc1cc3f59fb4fe6fac4bc18488b1800f9b9a82ed3d1f921994c8c9b729e5de547f2cda604b", 0x7b}, {&(0x7f0000000380)="2d37fce7fb", 0x5}, {&(0x7f00000003c0)="ccd7ef865ef40c9f3c2553a92bbb67a235e510d75ab1573674156d51a6e0c8e913b6bb1ac7b09f7c69c54c40b684af813432156da36363e13901ae0eb48111d887e6cc2113f5b60b8150c03153b7ab433253fbda00dbcbe3ff10b948e19518227d8d54cc00a8de5a316aab34ae628f3b3b6f51a72a254e47abfe746d7b07", 0x7e}], 0x3, &(0x7f0000000a00)=[@cred={{0x1c, 0x1, 0x2, {r2, r5, r6}}}, @cred={{0x1c, 0x1, 0x2, {r3, r7, r8}}}, @cred={{0x1c, 0x1, 0x2, {r2, r9, r10}}}, @rights={{0x24, 0x1, 0x1, [r1, r1, r1, r0, r0]}}, @cred={{0x1c, 0x1, 0x2, {r3, r11, r12}}}], 0xa8}], 0x1, 0x41)
setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000040), 0x4)
getsockopt$sock_timeval(r1, 0x1, 0x14, &(0x7f0000000140), &(0x7f0000000180)=0x10)
ioctl$EXT4_IOC_SWAP_BOOT(r4, 0x6611)
ioctl$VIDIOC_G_OUTPUT(r0, 0x8004562e, &(0x7f0000000100))
arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000))
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r4, 0x0, 0x8100000, 0x0)
lookup_dcookie(0x9, &(0x7f0000000b00)=""/4096, 0x1000)

[ 3357.871172][T21818] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3357.871665][T21777] CPU: 0 PID: 21777 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3357.888482][T21777] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3357.888488][T21777] Call Trace:
[ 3357.888509][T21777]  dump_stack+0x172/0x1f0
[ 3357.888530][T21777]  should_fail.cold+0xa/0x15
[ 3357.888552][T21777]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3357.916581][T21777]  ? ___might_sleep+0x163/0x280
[ 3357.921449][T21777]  __should_failslab+0x121/0x190
[ 3357.926387][T21777]  should_failslab+0x9/0x14
[ 3357.926403][T21777]  __kmalloc_track_caller+0x2d5/0x740
[ 3357.926418][T21777]  ? alloc_vfsmnt+0x28/0x780
[ 3357.926440][T21777]  ? kstrdup_const+0x66/0x80
[ 3357.940869][T21777]  kstrdup+0x3a/0x70
[ 3357.940888][T21777]  kstrdup_const+0x66/0x80
[ 3357.940909][T21777]  alloc_vfsmnt+0xba/0x780
[ 3357.949393][T21777]  ? kasan_check_read+0x11/0x20
[ 3357.949411][T21777]  clone_mnt+0x71/0xfe0
[ 3357.949427][T21777]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3357.949442][T21777]  ? is_subdir+0x28d/0x400
[ 3357.949463][T21777]  copy_tree+0x3ad/0x940
[ 3357.949489][T21777]  __do_loopback.isra.0+0x177/0x3b0
[ 3357.963135][T21777]  do_mount+0x163c/0x1c00
[ 3357.963164][T21777]  ? copy_mount_string+0x40/0x40
[ 3357.977427][T21777]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3357.977444][T21777]  ? _copy_from_user+0x12c/0x1a0
[ 3357.977466][T21777]  ? copy_mount_options+0x2db/0x3f0
[ 3357.977485][T21777]  ksys_mount+0xdb/0x150
[ 3358.016757][T21777]  __x64_sys_mount+0xbe/0x150
10:12:06 executing program 0:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3358.021456][T21777]  do_syscall_64+0xfd/0x680
[ 3358.025977][T21777]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3358.031879][T21777] RIP: 0033:0x459279
[ 3358.035952][T21777] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3358.047687][T21852] device nr0
 entered promiscuous mode
[ 3358.055556][T21777] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
10:12:06 executing program 3:
r0 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x7fff, 0x2)
getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x4, 0xb8f, 0x0, 0x6, 0xcfc, 0x187b, 0x3f, 0x8, <r1=>0x0}, &(0x7f0000000400)=0x20)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000340)={r1, @in6={{0xa, 0x4e22, 0x1f, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x4ae8a474}}, 0x3, 0x4}, &(0x7f00000000c0)=0x90)
getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000500)={<r2=>0x0, 0x5}, &(0x7f0000000540)=0x8)
getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000580)=@assoc_value={r2, 0x8001}, &(0x7f00000004c0)=0x8)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e23, @empty}}, [0x100, 0x7, 0x3, 0x4, 0x47, 0x1f, 0x2, 0x2, 0x3, 0xe0, 0x3, 0x4, 0xfffffffffffffff9, 0x9, 0xc2]}, &(0x7f0000000200)=0x100)
ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000240))
r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
bind$rose(r3, &(0x7f0000000280)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @bcast}, 0x1c)
connect$rose(r3, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:06 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7a00, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3358.055571][T21777] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3358.055580][T21777] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3358.055588][T21777] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3358.055598][T21777] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3358.055606][T21777] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:07 executing program 0:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
write$cgroup_int(0xffffffffffffffff, &(0x7f0000000080)=0xffffffff80000001, 0x12)
getsockname(0xffffffffffffffff, &(0x7f0000000000)=@isdn, &(0x7f0000000100)=0x80)
r1 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, &(0x7f0000000600)={@default, @null})
fchmod(r1, 0xa4)
splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x8100000, 0x0)
sendmsg$sock(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000180)=@generic={0x4, "6e5be74b9cd672a77f2d58dadd95ced3ed7e77768bd43c564accc73bc1ed709097ec8d9f49b50220babdc177645cb2876929afaae315145fa4d076ee79c978e7f02977e4004c533667ce4144ad2ebbde2d49a2619148952e1538d5243302b2859e9441512a56b7d6a1b30025e0f9bd8ba23078760450c94631824370d655"}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000280)="7f81574f2c6fdf7a74a6bb63cd77ff2fcc1c6e89c4a2da60cc9c064c7e9ae810ea69c03a5e3c0432056d4409ddb7a743dfe8a5f393eae8f8669dde7e14e9a094084a9bbc83cb7f897db73fa53fbec5dcf94dedf73cd3501a3d11acc476fe1d745eabcc7ec57c49f167f06453b697e52f31c35f4d6b5c6b183d5793a350584e43400f360dcdbc9322d8c2e4b9253a495bc31680d58260c70fedf3ff125c28ba7f2054e506a6017f7b2acafc28dfe23e17b3ed916001942839c92a6480511b94439294273a1e3564064a62fc7a", 0xcc}, {&(0x7f0000000380)="47d02f4f6dde717c3e7b2007d76118bcfb53ed028e8a023616697a878ccd71f67e5938ea32f8b4daaffac17da46f9c132d4197e87a801757d19b2931028677d7f8c04eb56627f5b15a5aeea1a10885709d9485a84860b1be2158e6e219c1575791256861abc0a2804c5059df7a89192cca8195b956ccd212e8dcab6c64217d05227dcb2e14bd6f905f96e567f3afced6e3dbd6c6cd4e14ee6c11eef5c5bf4acaf41c04413ecbce9bd7e1f1a1419aaed39acef71f4d4f67e37279ef948dbc876b8c3ec16daee32b7ee3be481c92a7a7823f11463de7d4f6bd10d29eb343150ad6c5cf3454160fe1e5c05d494e7ea06baf9f95c7583ebd65516df4e5", 0xfb}, {&(0x7f0000000480)="8166ec6e1f11239ded567ba7d1333ce9327946e4a6a1f6ec0cca561c10efdac4e0903287282a58d957c971d757ea1723baff95c80f3a0aedb67652145673050d994cbe1157ab481e518e454b65a219f3afefbbf80ca1ebcef637f50788aa80cf5127d22edd1ad65d9886e2545a9868b75699a8bb7b1f374d73a2a62c49176a1db992a2cfd25eff884f1582be31777b7b0a4984a4d51a5a839de904065148346baffea200495f8b702975ba0917", 0xad}], 0x3, &(0x7f0000000540)=[@timestamping={{0x14, 0x1, 0x25, 0x4600}}, @timestamping={{0x14, 0x1, 0x25, 0x6}}], 0x30}, 0x8014)

[ 3358.183227][T21949] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3358.228442][T21995] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:07 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3358.628498][T22101] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3358.658935][T22102] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:07 executing program 5:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:07 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_SET_NETID(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x308, 0x70bd25, 0x25dfdbfe, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xbb984f}}, ["", "", "", "", ""]}, 0x24}}, 0x90)
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x8, <r4=>0x0, 0x0, 0x9})
ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000080)={r4, 0x5})
write$cgroup_int(r1, &(0x7f0000000000)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:07 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='dctcp-reno\x00', 0xb)

10:12:07 executing program 2 (fault-call:5 fault-nth:25):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:07 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:07 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x30000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3358.819805][T22135] FAULT_INJECTION: forcing a failure.
[ 3358.819805][T22135] name failslab, interval 1, probability 0, space 0, times 0
[ 3358.866660][T22135] CPU: 0 PID: 22135 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3358.875743][T22135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3358.885798][T22135] Call Trace:
[ 3358.889097][T22135]  dump_stack+0x172/0x1f0
[ 3358.893440][T22135]  should_fail.cold+0xa/0x15
[ 3358.898049][T22135]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3358.903866][T22135]  ? ___might_sleep+0x163/0x280
[ 3358.908734][T22135]  __should_failslab+0x121/0x190
[ 3358.908929][T22139] device nr0
 entered promiscuous mode
[ 3358.913699][T22135]  should_failslab+0x9/0x14
[ 3358.913722][T22135]  __kmalloc_track_caller+0x2d5/0x740
[ 3358.913745][T22135]  ? alloc_vfsmnt+0x28/0x780
[ 3358.933685][T22135]  ? kstrdup_const+0x66/0x80
[ 3358.938296][T22135]  kstrdup+0x3a/0x70
[ 3358.942219][T22135]  kstrdup_const+0x66/0x80
[ 3358.946644][T22135]  alloc_vfsmnt+0xba/0x780
[ 3358.951071][T22135]  clone_mnt+0x71/0xfe0
[ 3358.955236][T22135]  ? kasan_check_read+0x11/0x20
[ 3358.960096][T22135]  ? do_raw_spin_unlock+0x57/0x270
[ 3358.965219][T22135]  copy_tree+0x3ad/0x940
[ 3358.969482][T22135]  __do_loopback.isra.0+0x177/0x3b0
[ 3358.974691][T22135]  do_mount+0x163c/0x1c00
[ 3358.979043][T22135]  ? copy_mount_string+0x40/0x40
[ 3358.983641][T22119] device nr0
 entered promiscuous mode
[ 3358.983997][T22135]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3358.995693][T22135]  ? _copy_from_user+0x12c/0x1a0
[ 3359.002179][T22135]  ? copy_mount_options+0x2db/0x3f0
[ 3359.007385][T22135]  ksys_mount+0xdb/0x150
[ 3359.011644][T22135]  __x64_sys_mount+0xbe/0x150
[ 3359.016333][T22135]  do_syscall_64+0xfd/0x680
[ 3359.020857][T22135]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3359.026763][T22135] RIP: 0033:0x459279
[ 3359.030664][T22135] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3359.050276][T22135] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3359.058692][T22135] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
10:12:07 executing program 0:
pipe(&(0x7f0000000140)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
fstatfs(r0, &(0x7f0000000280)=""/223)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:07 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3359.066678][T22135] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3359.074658][T22135] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3359.082633][T22135] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3359.090619][T22135] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:08 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:08 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x22, 0x10000)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00')
sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x240800}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r2, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x25f, 0x3f, 0xfffffffffffffffc, 0x6}}}, ["", "", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x1)

10:12:08 executing program 2 (fault-call:5 fault-nth:26):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:08 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
getsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000000)={@rand_addr, <r3=>0x0}, &(0x7f0000000040)=0x14)
setsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000100)={r3, @multicast2, @dev={0xac, 0x14, 0x14, 0xb}}, 0xc)
io_uring_register$IORING_UNREGISTER_EVENTFD(r1, 0x5, 0x0, 0x0)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0xa)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$int_out(r0, 0x0, &(0x7f0000000140))

[ 3359.482246][T22545] FAULT_INJECTION: forcing a failure.
[ 3359.482246][T22545] name failslab, interval 1, probability 0, space 0, times 0
[ 3359.516796][T22545] CPU: 1 PID: 22545 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3359.525864][T22545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3359.535931][T22545] Call Trace:
[ 3359.539251][T22545]  dump_stack+0x172/0x1f0
[ 3359.543613][T22545]  should_fail.cold+0xa/0x15
[ 3359.548221][T22545]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3359.554048][T22545]  ? ___might_sleep+0x163/0x280
[ 3359.558911][T22545]  __should_failslab+0x121/0x190
[ 3359.563856][T22545]  should_failslab+0x9/0x14
[ 3359.568386][T22545]  __kmalloc_track_caller+0x2d5/0x740
[ 3359.573767][T22545]  ? alloc_vfsmnt+0x28/0x780
[ 3359.578371][T22545]  ? kstrdup_const+0x66/0x80
[ 3359.582988][T22545]  kstrdup+0x3a/0x70
[ 3359.586900][T22545]  kstrdup_const+0x66/0x80
[ 3359.591411][T22545]  alloc_vfsmnt+0xba/0x780
[ 3359.595834][T22545]  clone_mnt+0x71/0xfe0
[ 3359.599998][T22545]  ? kasan_check_read+0x11/0x20
[ 3359.604852][T22545]  ? do_raw_spin_unlock+0x57/0x270
[ 3359.609977][T22545]  copy_tree+0x3ad/0x940
[ 3359.614245][T22545]  __do_loopback.isra.0+0x177/0x3b0
[ 3359.619458][T22545]  do_mount+0x163c/0x1c00
[ 3359.623806][T22545]  ? copy_mount_string+0x40/0x40
[ 3359.628750][T22545]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3359.634999][T22545]  ? _copy_from_user+0x12c/0x1a0
[ 3359.640038][T22545]  ? copy_mount_options+0x2db/0x3f0
[ 3359.645255][T22545]  ksys_mount+0xdb/0x150
[ 3359.649512][T22545]  __x64_sys_mount+0xbe/0x150
[ 3359.654216][T22545]  do_syscall_64+0xfd/0x680
[ 3359.658744][T22545]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3359.664641][T22545] RIP: 0033:0x459279
[ 3359.668546][T22545] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3359.688161][T22545] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3359.696597][T22545] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3359.704570][T22545] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3359.712546][T22545] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3359.720523][T22545] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3359.728501][T22545] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:08 executing program 5:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:08 executing program 0:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r0, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r2 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r2, 0x0, r1, 0x0, 0x8100000, 0xfffffffffffffffc)

10:12:08 executing program 4:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(r3, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="83658154b5b9b620d654eb0000000000000000", @ANYRES16=r4, @ANYBLOB="000225bd7000fcdbdf250e000000600004000c00010073797a310000000044000700080002000400000008000200fbffffff080001001c0000000800040007000000080003000002000008000200ff7f0000080002000700000008000400020000000c0007000800010019000000"], 0x74}}, 0x20000000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3360.085611][T22241] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3360.119883][T22633] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:08 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x7)
r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400002, 0x0)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400880}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r2, 0x600, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xec8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x24000050}, 0x40)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:09 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x34000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:09 executing program 2 (fault-call:5 fault-nth:27):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:09 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)={'team0\x00', <r3=>0x0})
ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={@rand_addr="5a1e3201f9729e829a4c501b14c4ee56", 0x38, r3})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:09 executing program 4:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(r3, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="83658154b5b9b620d654eb0000000000000000", @ANYRES16=r4, @ANYBLOB="000225bd7000fcdbdf250e000000600004000c00010073797a310000000044000700080002000400000008000200fbffffff080001001c0000000800040007000000080003000002000008000200ff7f0000080002000700000008000400020000000c0007000800010019000000"], 0x74}}, 0x20000000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3360.283173][T22652] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3360.351254][T22668] FAULT_INJECTION: forcing a failure.
[ 3360.351254][T22668] name failslab, interval 1, probability 0, space 0, times 0
[ 3360.403689][T22668] CPU: 0 PID: 22668 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3360.412776][T22668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3360.422841][T22668] Call Trace:
[ 3360.426237][T22668]  dump_stack+0x172/0x1f0
[ 3360.430593][T22668]  should_fail.cold+0xa/0x15
[ 3360.435209][T22668]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3360.441049][T22668]  ? ___might_sleep+0x163/0x280
[ 3360.445926][T22668]  __should_failslab+0x121/0x190
[ 3360.450877][T22668]  should_failslab+0x9/0x14
[ 3360.455389][T22668]  kmem_cache_alloc+0x2af/0x6f0
[ 3360.460253][T22668]  ? copy_tree+0x535/0x940
[ 3360.464685][T22668]  alloc_vfsmnt+0x28/0x780
[ 3360.469118][T22668]  clone_mnt+0x71/0xfe0
[ 3360.473282][T22668]  ? kasan_check_read+0x11/0x20
[ 3360.478138][T22668]  ? do_raw_spin_unlock+0x57/0x270
[ 3360.483268][T22668]  copy_tree+0x3ad/0x940
[ 3360.487545][T22668]  __do_loopback.isra.0+0x177/0x3b0
[ 3360.492762][T22668]  do_mount+0x163c/0x1c00
[ 3360.497118][T22668]  ? copy_mount_string+0x40/0x40
[ 3360.502073][T22668]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3360.508321][T22668]  ? _copy_from_user+0x12c/0x1a0
[ 3360.513286][T22668]  ? copy_mount_options+0x2db/0x3f0
[ 3360.518511][T22668]  ksys_mount+0xdb/0x150
[ 3360.522779][T22668]  __x64_sys_mount+0xbe/0x150
[ 3360.527482][T22668]  do_syscall_64+0xfd/0x680
[ 3360.532009][T22668]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3360.537917][T22668] RIP: 0033:0x459279
[ 3360.541826][T22668] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3360.561449][T22668] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3360.569880][T22668] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3360.577871][T22668] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3360.585977][T22668] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3360.593962][T22668] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
10:12:09 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f00000000c0)={0x50, 0xd123c331723280f8, 0x5, {0x7, 0x1e, 0x9, 0x8, 0x0, 0x7f, 0x8, 0x1}}, 0x50)

10:12:09 executing program 0:
pipe(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
close(r1)

[ 3360.601951][T22668] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3360.653861][T22640] device nr0
 entered promiscuous mode
10:12:09 executing program 2 (fault-call:5 fault-nth:28):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3360.694946][T22694] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:09 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x400300, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3360.880803][T22962] FAULT_INJECTION: forcing a failure.
[ 3360.880803][T22962] name failslab, interval 1, probability 0, space 0, times 0
[ 3360.918560][T22962] CPU: 1 PID: 22962 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3360.927640][T22962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3360.937706][T22962] Call Trace:
[ 3360.941022][T22962]  dump_stack+0x172/0x1f0
[ 3360.945372][T22962]  should_fail.cold+0xa/0x15
[ 3360.950058][T22962]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3360.955888][T22962]  ? ___might_sleep+0x163/0x280
[ 3360.960768][T22962]  __should_failslab+0x121/0x190
[ 3360.965811][T22962]  should_failslab+0x9/0x14
[ 3360.970324][T22962]  __kmalloc_track_caller+0x2d5/0x740
[ 3360.975705][T22962]  ? alloc_vfsmnt+0x28/0x780
[ 3360.980315][T22962]  ? kstrdup_const+0x66/0x80
[ 3360.984920][T22962]  kstrdup+0x3a/0x70
[ 3360.988824][T22962]  kstrdup_const+0x66/0x80
[ 3360.993248][T22962]  alloc_vfsmnt+0xba/0x780
[ 3360.997679][T22962]  clone_mnt+0x71/0xfe0
[ 3361.002590][T22962]  ? kasan_check_read+0x11/0x20
[ 3361.007460][T22962]  ? do_raw_spin_unlock+0x57/0x270
[ 3361.012600][T22962]  copy_tree+0x3ad/0x940
[ 3361.016874][T22962]  __do_loopback.isra.0+0x177/0x3b0
[ 3361.022084][T22962]  do_mount+0x163c/0x1c00
[ 3361.026430][T22962]  ? copy_mount_string+0x40/0x40
[ 3361.031375][T22962]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3361.037623][T22962]  ? _copy_from_user+0x12c/0x1a0
[ 3361.042576][T22962]  ? copy_mount_options+0x2db/0x3f0
[ 3361.047793][T22962]  ksys_mount+0xdb/0x150
[ 3361.052047][T22962]  __x64_sys_mount+0xbe/0x150
[ 3361.056740][T22962]  do_syscall_64+0xfd/0x680
[ 3361.061270][T22962]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3361.067176][T22962] RIP: 0033:0x459279
[ 3361.071113][T22962] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3361.090727][T22962] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3361.099148][T22962] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3361.107134][T22962] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3361.115111][T22962] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3361.123104][T22962] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3361.131089][T22962] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:10 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:10 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x8440, 0x0)
r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x800, 0x8000)
fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000040)='!security[c&\x00', &(0x7f0000000280)='./file0\x00', r0)
fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f00000003c0)='syz', &(0x7f00000002c0)="f01fe4782d6cd9f9b5c663bac2c39c02368f8e97969283ef13722dc05c716739b7adf2e4511cf88f10f04753855f47f73b1905cc451c966045abc43cd5b79fc596ce144380b0a5630ac299598c77fd82cdfe4bb95baefdec976e58f245625d27910bfecdc25ad4e30f0a8e9e07b67193d1624ee6ed8435e948c26006af397bdc665d3ff5289a156ab2be57d15bdd498551de83df", 0x4a)
r3 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0x0)
keyctl$get_keyring_id(0x0, r3, 0xfffffffffffffffe)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000140)={<r4=>0x0, 0x400, 0x4}, &(0x7f0000000180)=0x8)
ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f0000000400)={{0x2, 0x4e23, @multicast1}, {0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x0, {0x2, 0x4e24, @empty}, 'veth0_to_team\x00'})
setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r4, 0x86}, 0x8)

10:12:10 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x200008100000, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000100)={0xf3, 0x20, 0x0, "0a1fd9449e021bb19bcf627937f3dbaffb2054eff82ae6006b31a5256b164e0928ade20efc1575450a38872affcc9d28c2a2e2ad7c704380f059c3119e283954e953645ff5fa3cf7d572e5a1499a128fbe3c2ac7db46a83c52069accdf6d6cf8389b6f00236e5a5f71d8490fc89d2a375c4c28ca51a9b2df3cb503639939248ba4c9cfc185787753554ee9cf76db38d2fc78a69da2dec3347a9c8bc8ac4eed028ca387295edde55acd73c05aaecb65b66f9f8575ff9dc01407752b10e76db828a16bd70db5cb98f61597868ccbf2d99067a6d089645c909f34561f80496caef4b37f0b2d8bf12a433b60c7043c8a3535fafb38"})

10:12:10 executing program 4:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_GET(r3, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="83658154b5b9b620d654eb0000000000000000", @ANYRES16=r4, @ANYBLOB="000225bd7000fcdbdf250e000000600004000c00010073797a310000000044000700080002000400000008000200fbffffff080001001c0000000800040007000000080003000002000008000200ff7f0000080002000700000008000400020000000c0007000800010019000000"], 0x74}}, 0x20000000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:10 executing program 2 (fault-call:5 fault-nth:29):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:10 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf0ffff, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:10 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x1000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:10 executing program 4:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:10 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = dup3(r0, r0, 0x80000)
ioctl(r0, 0xcc6, &(0x7f00000000c0)="d4506bea73f3e98b20aaedb1bc641526cf2caad4a330564369161022d70adb8da8db0613c31a38394a4ab284b3db102a660797cf2b10c2f459a9ad70b6acc56d2a8bf7fb9779a784ba81")
ioctl$TCSETS(r1, 0x5402, &(0x7f0000000000)={0x6, 0x83, 0x7, 0xfffffffffffffffd, 0x11, 0xa9b0, 0x6, 0x14, 0x7, 0x40, 0x3b0, 0x80000001})

10:12:10 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
write$P9_RLOCK(r0, &(0x7f0000000000)={0x8, 0x35, 0x2, 0x3}, 0x8)
r3 = getpid()
syz_open_procfs(r3, &(0x7f0000000040)='wchan\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3361.434111][T23002] FAULT_INJECTION: forcing a failure.
[ 3361.434111][T23002] name failslab, interval 1, probability 0, space 0, times 0
[ 3361.509157][T23002] CPU: 1 PID: 23002 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3361.518477][T23002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3361.528721][T23002] Call Trace:
[ 3361.532032][T23002]  dump_stack+0x172/0x1f0
[ 3361.536390][T23002]  should_fail.cold+0xa/0x15
[ 3361.540996][T23002]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3361.546820][T23002]  ? ___might_sleep+0x163/0x280
[ 3361.551700][T23002]  __should_failslab+0x121/0x190
[ 3361.556648][T23002]  should_failslab+0x9/0x14
[ 3361.561160][T23002]  kmem_cache_alloc+0x2af/0x6f0
[ 3361.562056][T23089] device nr0
 entered promiscuous mode
[ 3361.566033][T23002]  ? copy_tree+0x535/0x940
[ 3361.566056][T23002]  alloc_vfsmnt+0x28/0x780
[ 3361.566074][T23002]  clone_mnt+0x71/0xfe0
[ 3361.566091][T23002]  ? kasan_check_read+0x11/0x20
[ 3361.566109][T23002]  ? do_raw_spin_unlock+0x57/0x270
[ 3361.566128][T23002]  copy_tree+0x3ad/0x940
[ 3361.598717][T23002]  __do_loopback.isra.0+0x177/0x3b0
[ 3361.603953][T23002]  do_mount+0x163c/0x1c00
[ 3361.608295][T23002]  ? copy_mount_string+0x40/0x40
[ 3361.613249][T23002]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3361.619497][T23002]  ? _copy_from_user+0x12c/0x1a0
[ 3361.624447][T23002]  ? copy_mount_options+0x2db/0x3f0
[ 3361.629662][T23002]  ksys_mount+0xdb/0x150
[ 3361.633913][T23002]  __x64_sys_mount+0xbe/0x150
[ 3361.638604][T23002]  do_syscall_64+0xfd/0x680
[ 3361.643123][T23002]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3361.649025][T23002] RIP: 0033:0x459279
10:12:10 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x2000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3361.652937][T23002] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3361.672563][T23002] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3361.672578][T23002] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3361.672585][T23002] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3361.672591][T23002] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
10:12:10 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
prctl$PR_GET_DUMPABLE(0x3)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3361.672599][T23002] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3361.672607][T23002] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:11 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x5196c2, 0x0)
write$UHID_INPUT2(r1, &(0x7f00000000c0)={0xc, 0x72, "ac3a9cc711050866281cb864ebe15dcc5366c119e042ea540ae7d6cd539ba460d8b02b529e6ceba8898ba59cce5d92b9d1a1885254f397661bd89e7ebb56da098c7c9553a6a817f136750c874b96080f87580af9dcacba2fa3a0121d5479554389a51754e62956b0bc8175a5bcbdf311a9e0"}, 0x78)

10:12:11 executing program 2 (fault-call:5 fault-nth:30):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:11 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(kw(khazad),md4)\x00'}, 0x58)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000000)=""/13)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:11 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x3000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:11 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:11 executing program 4:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:11 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x1, 0x2)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0, 0x0]}, &(0x7f0000000040)=0x28)
setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000100)={r3, @in={{0x2, 0x4e24, @local}}}, 0x84)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
r5 = getgid()
chown(&(0x7f0000000200)='./file0\x00', r4, r5)

10:12:11 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:11 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3362.354522][T23423] FAULT_INJECTION: forcing a failure.
[ 3362.354522][T23423] name failslab, interval 1, probability 0, space 0, times 0
[ 3362.408820][T23423] CPU: 1 PID: 23423 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3362.417896][T23423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3362.417904][T23423] Call Trace:
[ 3362.417929][T23423]  dump_stack+0x172/0x1f0
[ 3362.417956][T23423]  should_fail.cold+0xa/0x15
[ 3362.440256][T23423]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3362.446087][T23423]  ? ___might_sleep+0x163/0x280
[ 3362.450969][T23423]  __should_failslab+0x121/0x190
[ 3362.455919][T23423]  should_failslab+0x9/0x14
[ 3362.460446][T23423]  __kmalloc_track_caller+0x2d5/0x740
[ 3362.465834][T23423]  ? alloc_vfsmnt+0x28/0x780
[ 3362.470435][T23423]  ? kstrdup_const+0x66/0x80
[ 3362.470456][T23423]  kstrdup+0x3a/0x70
[ 3362.470474][T23423]  kstrdup_const+0x66/0x80
[ 3362.470488][T23423]  alloc_vfsmnt+0xba/0x780
[ 3362.470501][T23423]  ? kasan_check_read+0x11/0x20
[ 3362.470517][T23423]  clone_mnt+0x71/0xfe0
[ 3362.470531][T23423]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3362.470545][T23423]  ? is_subdir+0x28d/0x400
[ 3362.470565][T23423]  copy_tree+0x3ad/0x940
[ 3362.470591][T23423]  __do_loopback.isra.0+0x177/0x3b0
[ 3362.470612][T23423]  do_mount+0x163c/0x1c00
[ 3362.520839][T23423]  ? copy_mount_string+0x40/0x40
[ 3362.525795][T23423]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3362.532051][T23423]  ? _copy_from_user+0x12c/0x1a0
[ 3362.537019][T23423]  ? copy_mount_options+0x2db/0x3f0
[ 3362.542250][T23423]  ksys_mount+0xdb/0x150
[ 3362.546550][T23423]  __x64_sys_mount+0xbe/0x150
[ 3362.546920][T23420] device nr0
 entered promiscuous mode
[ 3362.551261][T23423]  do_syscall_64+0xfd/0x680
[ 3362.551285][T23423]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3362.551298][T23423] RIP: 0033:0x459279
[ 3362.551314][T23423] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3362.551321][T23423] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3362.551335][T23423] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
10:12:11 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
r4 = fcntl$dupfd(r1, 0x406, r1)
ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000002c0)=r4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:11 executing program 0:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r0, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r2 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r2, 0x0, r1, 0x0, 0xfd, 0x0)

[ 3362.551342][T23423] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3362.551350][T23423] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3362.551362][T23423] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3362.551369][T23423] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:11 executing program 2 (fault-call:5 fault-nth:31):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:11 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3362.832648][T23521] validate_nla: 10 callbacks suppressed
[ 3362.832658][T23521] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3362.860468][T23572] FAULT_INJECTION: forcing a failure.
[ 3362.860468][T23572] name failslab, interval 1, probability 0, space 0, times 0
[ 3362.888900][T23572] CPU: 1 PID: 23572 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3362.897990][T23572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3362.908069][T23572] Call Trace:
[ 3362.911385][T23572]  dump_stack+0x172/0x1f0
[ 3362.915767][T23572]  should_fail.cold+0xa/0x15
[ 3362.920377][T23572]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3362.926197][T23572]  ? ___might_sleep+0x163/0x280
[ 3362.931078][T23572]  __should_failslab+0x121/0x190
[ 3362.936026][T23572]  should_failslab+0x9/0x14
[ 3362.940538][T23572]  kmem_cache_alloc+0x2af/0x6f0
[ 3362.945480][T23572]  ? copy_tree+0x535/0x940
[ 3362.949917][T23572]  alloc_vfsmnt+0x28/0x780
[ 3362.954347][T23572]  clone_mnt+0x71/0xfe0
[ 3362.958511][T23572]  ? kasan_check_read+0x11/0x20
[ 3362.963370][T23572]  ? do_raw_spin_unlock+0x57/0x270
[ 3362.968492][T23572]  copy_tree+0x3ad/0x940
[ 3362.972760][T23572]  __do_loopback.isra.0+0x177/0x3b0
[ 3362.977971][T23572]  do_mount+0x163c/0x1c00
[ 3362.982341][T23572]  ? copy_mount_string+0x40/0x40
[ 3362.987322][T23572]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3362.993576][T23572]  ? _copy_from_user+0x12c/0x1a0
[ 3362.998544][T23572]  ? copy_mount_options+0x2db/0x3f0
[ 3363.004677][T23572]  ksys_mount+0xdb/0x150
[ 3363.008933][T23572]  __x64_sys_mount+0xbe/0x150
[ 3363.013640][T23572]  do_syscall_64+0xfd/0x680
[ 3363.018192][T23572]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3363.024111][T23572] RIP: 0033:0x459279
[ 3363.028032][T23572] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3363.047640][T23572] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3363.047654][T23572] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3363.047663][T23572] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3363.047672][T23572] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3363.047680][T23572] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
10:12:11 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x6, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000040)=0x13, 0x4)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x1f, 0x5, 0x0, 0x2, 0x6, 0x1000, 0xff, 0x5, 0x5f, 0x7, 0x3, 0xffffffffffffffff, 0x7fffffff}, {0x7ff, 0x40, 0x9, 0x8, 0xfffffffffffff000, 0x0, 0x8000, 0x9, 0x6, 0x80, 0x704400000000000, 0x0, 0x7}, {0x2, 0x9, 0x4, 0x3a5, 0x5ae2, 0x1dd, 0x20, 0x9, 0xcdc2, 0x6, 0x40, 0x5, 0x9}], 0x80000000})
ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f00000000c0))

10:12:11 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff7ffffffe, 0xfffffdb6)
prctl$PR_MCE_KILL(0x21, 0x0, 0x2)
ftruncate(r1, 0x5)
mq_open(&(0x7f0000000040)='\x00', 0x43, 0xfebe0b2ea84b8f5c, &(0x7f0000000100)={0x7fff, 0x9, 0x2, 0x7ff, 0x101, 0x0, 0x4fb4295, 0x80ee})
openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x101000, 0x0)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$VIDIOC_OVERLAY(r3, 0x4004560e, &(0x7f0000000140)=0x800)

[ 3363.047696][T23572] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:11 executing program 2 (fault-call:5 fault-nth:32):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3363.272477][T23526] device nr0
 entered promiscuous mode
[ 3363.280641][T23733] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3363.519050][T23839] FAULT_INJECTION: forcing a failure.
[ 3363.519050][T23839] name failslab, interval 1, probability 0, space 0, times 0
[ 3363.553067][T23839] CPU: 0 PID: 23839 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3363.562145][T23839] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3363.562152][T23839] Call Trace:
[ 3363.562177][T23839]  dump_stack+0x172/0x1f0
[ 3363.562204][T23839]  should_fail.cold+0xa/0x15
[ 3363.562235][T23839]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3363.575567][T23839]  ? ___might_sleep+0x163/0x280
[ 3363.575590][T23839]  __should_failslab+0x121/0x190
[ 3363.575608][T23839]  should_failslab+0x9/0x14
[ 3363.584499][T23839]  __kmalloc_track_caller+0x2d5/0x740
[ 3363.584516][T23839]  ? alloc_vfsmnt+0x28/0x780
[ 3363.584536][T23839]  ? kstrdup_const+0x66/0x80
[ 3363.584556][T23839]  kstrdup+0x3a/0x70
[ 3363.595185][T23839]  kstrdup_const+0x66/0x80
[ 3363.595201][T23839]  alloc_vfsmnt+0xba/0x780
[ 3363.595218][T23839]  clone_mnt+0x71/0xfe0
[ 3363.595237][T23839]  ? kasan_check_read+0x11/0x20
[ 3363.604647][T23839]  ? do_raw_spin_unlock+0x57/0x270
[ 3363.604667][T23839]  copy_tree+0x3ad/0x940
[ 3363.604694][T23839]  __do_loopback.isra.0+0x177/0x3b0
[ 3363.614654][T23839]  do_mount+0x163c/0x1c00
[ 3363.614676][T23839]  ? copy_mount_string+0x40/0x40
[ 3363.614697][T23839]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3363.670947][T23839]  ? _copy_from_user+0x12c/0x1a0
[ 3363.675901][T23839]  ? copy_mount_options+0x2db/0x3f0
[ 3363.681139][T23839]  ksys_mount+0xdb/0x150
[ 3363.685412][T23839]  __x64_sys_mount+0xbe/0x150
[ 3363.690102][T23839]  do_syscall_64+0xfd/0x680
[ 3363.694619][T23839]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3363.700558][T23839] RIP: 0033:0x459279
[ 3363.704470][T23839] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3363.724094][T23839] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3363.732519][T23839] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3363.740494][T23839] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3363.748466][T23839] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3363.756440][T23839] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3363.764417][T23839] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:12 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:12 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000000)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x41)
r1 = dup2(r0, r0)
ioctl$DRM_IOCTL_AGP_INFO(r1, 0x80386433, &(0x7f0000000040)=""/160)

10:12:12 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x5000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:12 executing program 2 (fault-call:5 fault-nth:33):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:12 executing program 4:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:12 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
setsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000200)=@int=0x401, 0x4)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00')
semget(0x2, 0x2, 0x8)
ioctl$KDGETLED(r1, 0x4b31, &(0x7f00000002c0))
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x24, r3, 0x600, 0x70bd27, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x306, 0x11, 0x5}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80c4}, 0x20000000)
r4 = semget(0x0, 0x3, 0x10a)
semctl$SETALL(r4, 0x0, 0x11, &(0x7f0000000000)=[0x1, 0x2, 0x400, 0x100000000, 0x66, 0x6f, 0x7, 0x7fffffff])
dup2(r2, r2)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')

[ 3364.118442][T23845] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3364.156099][T23870] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:13 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x8200, 0x0)
accept4$bt_l2cap(r1, &(0x7f0000000200), &(0x7f0000000240)=0xe, 0x80800)
fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="050302000000020000fb507e193d43a2ebc8ba4fca14698cbe0760012aec7e9ea54bb1e95c25304c1feea4eef7c33845f60500c2631391e645428f23f5f6168071bd7250048b311dcdc0418d7a85e310d1cc79b858980c1e9928137b29d78fc3a189252c3d8009016dbd6ce84c5e5557d09e857cb61d2aca9abc7a38f67ec77d5c68796ab8e1ab5af7038606d6ec6c0831793b64e3ec38f5d97867879cfd1dbbb712fe74fecc09321b4dc370e50ba4ad41b7627f62e1b635e532a3da0ed66ba622d4c38355713e36052c435a23338773229a22d4d49bf093497678fe1da5319c8780ce7ebf7a04a1937c0d0dc4ce3ae88df2d1fd8cb6f35c914d92c445a3e7a04dbb18420b9d5b5ffd1f94dedb00"/280], 0x105, 0x1)

10:12:13 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:13 executing program 0:
pipe(&(0x7f00000000c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
r1 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r0, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r1, 0x0, 0x8100000, 0x0)

[ 3364.334304][T24056] FAULT_INJECTION: forcing a failure.
[ 3364.334304][T24056] name failslab, interval 1, probability 0, space 0, times 0
[ 3364.385199][T24056] CPU: 0 PID: 24056 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3364.394273][T24056] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3364.404336][T24056] Call Trace:
[ 3364.406630][T23850] device nr0
 entered promiscuous mode
[ 3364.407636][T24056]  dump_stack+0x172/0x1f0
[ 3364.407659][T24056]  should_fail.cold+0xa/0x15
[ 3364.407680][T24056]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3364.407702][T24056]  ? ___might_sleep+0x163/0x280
[ 3364.432694][T24056]  __should_failslab+0x121/0x190
[ 3364.437649][T24056]  should_failslab+0x9/0x14
[ 3364.442165][T24056]  kmem_cache_alloc+0x2af/0x6f0
[ 3364.447035][T24056]  alloc_vfsmnt+0x28/0x780
[ 3364.451467][T24056]  ? kasan_check_read+0x11/0x20
[ 3364.456327][T24056]  clone_mnt+0x71/0xfe0
[ 3364.460483][T24056]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3364.466213][T24056]  ? is_subdir+0x28d/0x400
[ 3364.470642][T24056]  copy_tree+0x3ad/0x940
[ 3364.474913][T24056]  __do_loopback.isra.0+0x177/0x3b0
[ 3364.480126][T24056]  do_mount+0x163c/0x1c00
[ 3364.484474][T24056]  ? copy_mount_string+0x40/0x40
[ 3364.489427][T24056]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3364.495886][T24056]  ? _copy_from_user+0x12c/0x1a0
[ 3364.500836][T24056]  ? copy_mount_options+0x2db/0x3f0
[ 3364.506054][T24056]  ksys_mount+0xdb/0x150
[ 3364.510309][T24056]  __x64_sys_mount+0xbe/0x150
[ 3364.515003][T24056]  do_syscall_64+0xfd/0x680
[ 3364.519525][T24056]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3364.525420][T24056] RIP: 0033:0x459279
[ 3364.529321][T24056] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3364.548933][T24056] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3364.557349][T24056] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3364.565335][T24056] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3364.573309][T24056] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
10:12:13 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f0000002640)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000002680)=0x14)
connect$can_bcm(r1, &(0x7f00000026c0)={0x1d, r2}, 0x10)

10:12:13 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00')
sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)={0x250, r3, 0x702, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x484}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x440000000000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER={0x100, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'vxcan1\x00'}}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'syzkaller0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1d}}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x9, @loopback, 0x4}}}}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff00000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffeffff}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'irlan0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'caif0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x54, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xd97a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x40010}, 0x20000004)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000000), &(0x7f0000000040)=0x4)

[ 3364.581292][T24056] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3364.589265][T24056] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:13 executing program 2 (fault-call:5 fault-nth:34):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3364.666648][T24078] device nr0
 entered promiscuous mode
[ 3364.684563][T24266] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3364.873425][T24374] FAULT_INJECTION: forcing a failure.
[ 3364.873425][T24374] name failslab, interval 1, probability 0, space 0, times 0
[ 3364.921888][T24374] CPU: 0 PID: 24374 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3364.930970][T24374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3364.941037][T24374] Call Trace:
[ 3364.944342][T24374]  dump_stack+0x172/0x1f0
[ 3364.948686][T24374]  should_fail.cold+0xa/0x15
[ 3364.953293][T24374]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3364.959106][T24374]  ? ___might_sleep+0x163/0x280
[ 3364.963985][T24374]  __should_failslab+0x121/0x190
[ 3364.968968][T24374]  should_failslab+0x9/0x14
[ 3364.973475][T24374]  kmem_cache_alloc+0x2af/0x6f0
[ 3364.978341][T24374]  ? copy_tree+0x535/0x940
[ 3364.982768][T24374]  alloc_vfsmnt+0x28/0x780
[ 3364.987195][T24374]  clone_mnt+0x71/0xfe0
[ 3364.991624][T24374]  ? kasan_check_read+0x11/0x20
[ 3364.996485][T24374]  ? do_raw_spin_unlock+0x57/0x270
[ 3365.003152][T24374]  copy_tree+0x3ad/0x940
[ 3365.007428][T24374]  __do_loopback.isra.0+0x177/0x3b0
[ 3365.012659][T24374]  do_mount+0x163c/0x1c00
[ 3365.017015][T24374]  ? copy_mount_string+0x40/0x40
[ 3365.021971][T24374]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3365.028226][T24374]  ? _copy_from_user+0x12c/0x1a0
[ 3365.033192][T24374]  ? copy_mount_options+0x2db/0x3f0
[ 3365.038420][T24374]  ksys_mount+0xdb/0x150
[ 3365.042675][T24374]  __x64_sys_mount+0xbe/0x150
[ 3365.047374][T24374]  do_syscall_64+0xfd/0x680
[ 3365.051899][T24374]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3365.057805][T24374] RIP: 0033:0x459279
[ 3365.061920][T24374] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3365.081544][T24374] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3365.089974][T24374] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3365.097960][T24374] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3365.105950][T24374] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3365.113931][T24374] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3365.121912][T24374] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3365.161852][T24269] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:14 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:14 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000040)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x6, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x179)
ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000000))

10:12:14 executing program 2 (fault-call:5 fault-nth:35):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:14 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:14 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000040)=0xffffffff80000001, 0xffffffffffffff22)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:14 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
r4 = fcntl$dupfd(r1, 0x406, r1)
ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000002c0)=r4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3365.570139][T24391] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:14 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000000)=0xefdfffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:14 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
r4 = fcntl$dupfd(r1, 0x406, r1)
ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000002c0)=r4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3365.612045][T24430] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3365.672489][T24400] FAULT_INJECTION: forcing a failure.
[ 3365.672489][T24400] name failslab, interval 1, probability 0, space 0, times 0
[ 3365.704157][T24400] CPU: 0 PID: 24400 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3365.713228][T24400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3365.713236][T24400] Call Trace:
[ 3365.713262][T24400]  dump_stack+0x172/0x1f0
[ 3365.713285][T24400]  should_fail.cold+0xa/0x15
[ 3365.713309][T24400]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3365.713333][T24400]  ? ___might_sleep+0x163/0x280
[ 3365.713358][T24400]  __should_failslab+0x121/0x190
[ 3365.713374][T24400]  should_failslab+0x9/0x14
[ 3365.713390][T24400]  kmem_cache_alloc+0x2af/0x6f0
[ 3365.713415][T24400]  alloc_vfsmnt+0x28/0x780
[ 3365.713429][T24400]  ? kasan_check_read+0x11/0x20
[ 3365.713446][T24400]  clone_mnt+0x71/0xfe0
[ 3365.713459][T24400]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3365.713482][T24400]  ? is_subdir+0x28d/0x400
[ 3365.726870][T24400]  copy_tree+0x3ad/0x940
[ 3365.726898][T24400]  __do_loopback.isra.0+0x177/0x3b0
[ 3365.726921][T24400]  do_mount+0x163c/0x1c00
[ 3365.798067][T24400]  ? copy_mount_string+0x40/0x40
[ 3365.798087][T24400]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3365.798102][T24400]  ? _copy_from_user+0x12c/0x1a0
[ 3365.798123][T24400]  ? copy_mount_options+0x2db/0x3f0
10:12:14 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:14 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x121200, 0x0)
fcntl$dupfd(r0, 0x0, r1)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')

[ 3365.814250][T24400]  ksys_mount+0xdb/0x150
[ 3365.814269][T24400]  __x64_sys_mount+0xbe/0x150
[ 3365.814288][T24400]  do_syscall_64+0xfd/0x680
[ 3365.814310][T24400]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3365.814322][T24400] RIP: 0033:0x459279
[ 3365.814339][T24400] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3365.814347][T24400] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3365.823799][T24400] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3365.832953][T24400] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3365.832962][T24400] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3365.832971][T24400] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3365.832980][T24400] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:14 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
r4 = fcntl$dupfd(r1, 0x406, r1)
ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000002c0)=r4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:14 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = fcntl$dupfd(r2, 0x406, r2)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r4 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r5 = add_key$keyring(&(0x7f0000000480)='keyring\x00', &(0x7f00000002c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc)
r6 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f00000004c0)={'syz'}, 0x0, 0x0, r5)
ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r3, 0x800443d3, &(0x7f0000000280)={{0x5, 0x3f, 0x1, 0x0, 0x5, 0x5}, 0xf05c, 0x5128, 0xffffffffffff8001})
add_key(&(0x7f0000000100)='dns_resolver\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000140)="dee7030022cf9e5e1dbac27b0426fc0299c41fb9b9761a1b44dac894f365ae68edf335abf35ec53d6751467ebd2c187491bcab2c8d34fec505fc8a14622dba33ff9b054eb7e8a5bc4ab2719cb230328931deb95ef3fcafb1ce27743a93f4715976ede8860ab49c3a4f51ab0124b50c3362201a307df03000", 0x78, r6)
keyctl$search(0xa, r6, &(0x7f00000000c0)='dns_resolver\x00', &(0x7f0000000040)={'syz', 0x1}, 0x0)
openat$pidfd(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self\x00', 0x8000, 0x0)
ioctl$UFFDIO_COPY(r4, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x2000, 0x1})
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000300)={<r7=>0x0, 0xdb, "40f0eb549228082d46a6486b832951021793b8bc48c104a62f047d2b6285b7449b3a86c473c056d7a93b2d7942387b7f928c84a6bf98788d508cc701a16fa091d2970f947e927f0fb99b8d4bf364ca2990c69e2e6468b1b843e700def796c19bc7c2d6fa31b0235384564413b0b1ad29513c62a11b957aa4ec3f576572cb9ee1047cd19b523cb878a5b75f5701fc28663cd58f52e819ee5d746e04bade8376ff736432b6a9c31994d32717f980881f4a49b2addbde0f38bc22b059e2ee52193f99cd1a00bc1fbc122d6e1de0ec3b1d7f186070020f43bbee4e4b3b"}, &(0x7f0000000200)=0xe3)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000500)={r7, @in={{0x2, 0x4e24, @multicast2}}, 0x8, 0x40, 0x2, 0x3e9, 0x20}, 0x98)

[ 3365.916743][T24493] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3366.070658][T24470] device nr0
 entered promiscuous mode
[ 3366.101103][T24501] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:15 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:15 executing program 2 (fault-call:5 fault-nth:36):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:15 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
getsockname(r0, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x80)
getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000100)={<r2=>0x0, 0xffffffff}, &(0x7f0000000140)=0x8)
setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000180)={r2, 0x7}, 0x8)

10:12:15 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
r4 = fcntl$dupfd(r1, 0x406, r1)
ioctl$TUNSETSTEERINGEBPF(r3, 0x800454e0, &(0x7f00000002c0)=r4)

10:12:15 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa3a0000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:15 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$bt_BT_SECURITY(r1, 0x112, 0x4, &(0x7f0000000000), 0x2)

[ 3366.684365][T24807] FAULT_INJECTION: forcing a failure.
[ 3366.684365][T24807] name failslab, interval 1, probability 0, space 0, times 0
[ 3366.716401][T24807] CPU: 0 PID: 24807 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3366.725487][T24807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3366.735570][T24807] Call Trace:
[ 3366.738880][T24807]  dump_stack+0x172/0x1f0
[ 3366.743232][T24807]  should_fail.cold+0xa/0x15
[ 3366.747845][T24807]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3366.753669][T24807]  ? ___might_sleep+0x163/0x280
[ 3366.758559][T24807]  __should_failslab+0x121/0x190
[ 3366.758577][T24807]  should_failslab+0x9/0x14
[ 3366.758591][T24807]  __kmalloc_track_caller+0x2d5/0x740
[ 3366.758617][T24807]  ? alloc_vfsmnt+0x28/0x780
[ 3366.778017][T24807]  ? kstrdup_const+0x66/0x80
[ 3366.778038][T24807]  kstrdup+0x3a/0x70
[ 3366.778065][T24807]  kstrdup_const+0x66/0x80
[ 3366.790956][T24807]  alloc_vfsmnt+0xba/0x780
[ 3366.795385][T24807]  ? kasan_check_read+0x11/0x20
[ 3366.800288][T24807]  clone_mnt+0x71/0xfe0
[ 3366.800303][T24807]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3366.800317][T24807]  ? is_subdir+0x28d/0x400
[ 3366.800344][T24807]  copy_tree+0x3ad/0x940
[ 3366.818970][T24807]  __do_loopback.isra.0+0x177/0x3b0
[ 3366.824194][T24807]  do_mount+0x163c/0x1c00
[ 3366.828548][T24807]  ? copy_mount_string+0x40/0x40
[ 3366.833504][T24807]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3366.839760][T24807]  ? _copy_from_user+0x12c/0x1a0
[ 3366.844713][T24807]  ? copy_mount_options+0x2db/0x3f0
[ 3366.844734][T24807]  ksys_mount+0xdb/0x150
[ 3366.854167][T24807]  __x64_sys_mount+0xbe/0x150
[ 3366.858860][T24807]  do_syscall_64+0xfd/0x680
[ 3366.863394][T24807]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3366.869313][T24807] RIP: 0033:0x459279
10:12:15 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f00000000c0)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0xfffffffffffffe82)
r1 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x7ff, 0x400)
ioctl$KVM_INTERRUPT(r1, 0x4004ae86, &(0x7f0000000100)=0x741c)
ioctl$VIDIOC_QUERYCTRL(r0, 0xc0445624, &(0x7f0000000000)={0x80a, 0x4, "f4dcacccdfb154df82776acbebf02aace0a7448c91f386f4bf0fa29d59bbc742", 0x81, 0x8000, 0x1, 0x1, 0x2})

10:12:15 executing program 0:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$TCSETXF(r3, 0x5434, &(0x7f0000000000)={0x7f, 0x2, [0x4, 0x4, 0x6, 0x3, 0xfffffffffffffff9], 0x400})

10:12:15 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)
fcntl$dupfd(r1, 0x406, r1)

10:12:15 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xe000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3366.869329][T24807] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3366.869336][T24807] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3366.869349][T24807] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3366.869357][T24807] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3366.869373][T24807] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3366.892873][T24807] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3366.892882][T24807] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:15 executing program 0:
pipe(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(0xffffffffffffffff)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
fchdir(r1)
r2 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)={0x10001, {0x0, 0x100000000, 0x1000, 0x9, 0x3, 0x67e}})
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)
setsockopt(r2, 0x10000, 0x400, &(0x7f0000000140)="ac276c12f815ecdcb0d715031172bcdeb616f7d20e6cbde839a884204018bd70e359c6915ae86a97b8ec85421c483a2b94e6288b2f5e1d188925ac6d540c1bebbfd78c34b9d3c65270fd18c3b8861f4edce1a2b39bd9339b4ceffd804121818fe1d21be229cba9ae60d2f951a5d069cf2754073ed433952eb0047f3138d672d980af9e947426af0b6325960707ea6b0570a0008df28dcefb3fd223fe4c0f7fea6a707e4aa8ce13093cc33024566db78b5c187ef8c24284a924882a24834f4f276efa2bb0c7b590db78", 0xc9)

10:12:15 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3367.055816][T24879] device nr0
 entered promiscuous mode
10:12:16 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:16 executing program 2 (fault-call:5 fault-nth:37):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:16 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)
openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x440000, 0x0)

10:12:16 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
socket$pptp(0x18, 0x1, 0x2)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000000)={<r4=>0x0, 0x9}, &(0x7f0000000040)=0x8)
getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000100)={r4, 0x9, 0x30}, &(0x7f0000000140)=0xc)

10:12:16 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x9, 0x600000)
sendmmsg$alg(r1, &(0x7f0000001c80)=[{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000000c0)="acabd1af19bfe2fe2411e6e9f4a41c582af5534bf8b50071b8a4546c8ca5c4390e31cf1ad720190445cd2ca778c835221c84b22aad93119f9097ddf86323c75afbbdcf3020d287cb1ae8a3635fefa855fb39a59de663586f8390ac9311a9f536de5e4564341a866020d76d48cf6b4998a433630493faea332d4fe4c433527fc17a7576938623239fbe16c71fc77492fd36c04da30a9fa97f11ac7b6d879093e2fcf5eb08d1210f9739edac2a39a6dfa2d660339662a641b38d13c208fa3934018a66a35abb73b929ac69c403cf3dbc76b99e4a008e9a500ec7885c68f1d86245af1a0122ece2e89db4687a", 0xeb}, {&(0x7f00000001c0)="a244a6c2848d0ded1ac9773c771310789b016c6d6c5fc75b1409d874deb56e319034a4c8d7ff6c0484b730269f2f4df291400a1d5a6a917ec7e6bd6c338dfa42ed3ea04dfb4d092e068bbcc1835c4b8dff05bd68ab4d3a5ab67ecfd940a3ad0af69fcb92d1c8825595f133f807f8eb62fc5f143d0db49f3e8819e891c4eb6175b08160bd9807b91c7a80fead271f0e68ec78c7fed87cb3d55042bab278c4843eb38017739ecb53d429a63e6386139e1d355693fd3b0bd9a55fb6d633", 0xbc}, {&(0x7f0000000040)="b47e5a520504deda892daa142136282ce933fd0f21a7eeaa820cd90996c7e5a3337dc1", 0x23}, {&(0x7f0000000280)="a60a8e59d95da57483efcfd5148251e5b86058124fe1bb640835d189b62532916ceed8d2", 0x24}, {&(0x7f00000002c0)="0fbefb06af283966d2272a66a9e20c6876d872435f9f9a19dc00cfa97c7c3f697fe7fdc48b46bedcb281eca3f3ec1ee037393c7f2966f1aee2bc0e8df6365d56b1860b2be0d605c2a408d795e24dfb93d21768d6e821b381e8d68c581897515c964a18dff5a34b9d41eb876553b9031ae1fc9d08bb2655678906699fb041be3dfe519126afbeb330d76f28d221bf4e2b55a0e743", 0x94}, {&(0x7f0000000380)="7a288610c474e0da97aadbe74b98ae3de7a4be9ddb9f438fe1c6e5024672308f389b216f3114e24683c790f919ea5cb8976938f860e94e81816a05947582d73072263ae894b63928ee5bfb3822f5f836296caac92e2d18ef24c53cf882cd0bd4d0f5f0570ad823fc5d29ec98c8b386ab103a638dfd700cfff6bf4964dba985886cfc35ce6b1936f6cf707112a645e9063e73977488d229e6036d4f24b93b44e509dd411c3db1bb747b4828129ec4d980f2d0cf9ff62aab9ed7c52642ad7087988a4fb2f6f25e598a72a7e29003d7548f20e0b032a062f10c2f12047ca814996c229dadef0c1c84e0a2492eee2e48c644afd11a8431866dadf1caf8947e", 0xfd}, {&(0x7f0000000480)="af7ee09e2f5dde81d287a12d", 0xc}], 0x7, 0x0, 0x0, 0x24004000}, {0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000540)="3a58e5deeb64410faf261333ccd23c96dab248ffa6866d9ded3a60f74bfd730b6f2905a99b4b19519f235473e1e8fca9a1786e81ee4ad608efd90f39d770eba0b2df3aeba30c6bd4f4bf7ff2d56b7c753863592dd860090fdcce95b7c0ae577bad4da01723058bafee14ecbba8852d361feb3398d8b8a62f5ba6b7da4522cdbeb513a49068f7c22ae47e25ce6130cf5b875d1ffacdbe96cbc13d9a2e8d9376d8847ef99b55e90b125ebea871087440ae96c02df1d6a9ed6ab27a189fd56bc2004b1925efa3726e6b21b059ae1da15b8c170fc907efd3761fa48951e3f83b6417dc86ae18943a74276cdfa87b67e3c45f77d62475546a11b1b75576817c597253eaef771509fcca5a7e54bbf95f94a150655338db81360182fb378c67eccfed1d9277bb0425fbeef6a357da1039093a725c004fb4684e7bf1c1c7f576323013524989bcf98aecc5fe8fff9e841ab107967c9a2ad299e1f30f93929a1e36644d435b3baacc5e6899a5314b00aa9906321f0ba7668b74dc9df5e8e775d6092a07973cb461b570082bcc6a443b6d136d1128b9ed369a889e202ed5aeac52e7505594977fdfec06a28f8bbb1948725189f19fc51c46ac2101f94675ecbc187e086bfff7fb9bd7765e15eaa080e632d6cb3a32725ec06ad8a9b0e20295382cd704a4c9db3cc8044cd5dc5460c0c6039e6db7ad3fee2573f1142d45f70bd6d32606bb8a86b98494fcedf56063ae48d4db06cc19357af34f6a981dab0ab1f51eeb6bc4b354e1fc4d75ed599e30eb43a9ebcd71364c80a504ca6aaabf112888607ee6fb056af17eb40375fdf9d260f65255b3029af376710542fb948c6270c6e0c9d4cc42ef62781537dbf0a336a7c567f172fa27f5a33a5053cc0687df91424ba70d11a148115102d68e2d3d183c5a56be05d3a80faa354f0046111ba67a7d13ddff0ec307f3d8d9a6f37315ee54a182be63c68df7f1adb84d0fb26b5a51d00821a9049eed663469b2adb1e85a62a7649dab3e8bea2a9373901d8e7191575a2b55a489ef4616ee29629ad495602764995ca75f2c26fb3696c3e2a09e92faef549715463b2b398a7a5cfd278c049f7cde4866b4514ab4ab5a3dea58a7da7b4d1d409d0717335b6997c1d9033e5b645f12bf46f7dcc21de8eb20ec0cfe2881cf3ce44fe44ebdfa98393e3f92169fb9a3ef44434672db8e66d31e1426b54f48e173abc707ec8a6a8c7a020c5613e11e6925756a243195283ef94c385decdac30eb237de908d9fb1a7604b41c3aadebaa17b55e27f6ea198c5ba51527fef050db38d87d1571c31cba4bf3bc544a01b44fe97c4e4968a5e32c672ba9a0307a78973d7e60ca621c8a1bd0b21e7b4e3b65bfb690e53c8104653f1a84550a299cfcf38b08fa4437a3f4ce0037cbbeaf8b5cdc46e9866cd43dd7cb076c783c9aa430d7a4beab13bf7ab06e73c39526e5bb7da6d41dd88b50b5871e5ab7b56439c78c1b7fbe7b366ac4ce68b21b853d5f827c0ae24e87ad07976f3c6414072bb05d4939037166410d3188b2235c1fc406dbeef856eaa9cfd243ce26e8a4e6c848921758dcaf5ffcdcc2c5f2363c113758963971dbc7977e03c667eb9f7121fb761c4d63c5591391e78129275b3e6a6d78ed71e6cfa7fa915dd0d44b572caf500d4d2671a206250e8ea5f204cc92f4f4b524ffb600841896c4a93a3d1e6bbd052a710e125c86b912785edd648fd4dab3d3aae6cf0644ae1349cc502f110d7276e9475f9a7a37720f511219856c836738dbad62a26f6b5624d5225749be0498dd6917233e0a26da629d537b556576a3b98b7ffe58f39afb13e32e858be344cebbdc8ac88e28eeae227a2728cdb98582c3f9eff1f2655a6263e51d7df591b3f47c5664f82eb03c9726a1690651d28dc15071c2d382dedde769036ce4f22e517619bd367ae431c83f0d7285dc65cca8875f889289e54d531aa501780d7ba614e19ba5005b1b45d59818f1398d0157bd0165e12c524e9fb9b8915e096fb7e96a0f3a40010a75b514a64f7d2d8a67ef4b15c0ca08e76575e63a8c3c378c6f46ade55049b9a316f0bd04876f7b5201dd3f311e433c57a079a3390c2bcad2bcf9436ab9718fdbd1f2843db6ed34d6c633d519ad14d4f1774fc86f68e96a9e752a71ab66292c789b8adc80d7f7f1ec933d7a58e2ef1d571cba58703318707fe2810f26e423f4072bd754555d307d4a564e01c01cf7323a8f2f1e2b2f26df6643521e8fbc50f6d37d0b5f9eaa17d9db7e3d6d62a3f7a3314f0846996b6479341dbe4aba5bf4b29a784189e1a6d3c3db58c5b3885bd52add5ef21a439fc2f9a4372d821cb12704ae0993b8997569dfe0bf973b42312e211b3d69dd829fa06075e1256ed8c1b32a6565b0060ab5c2e6cb9303f93e16063f0951505ed478933b44631cd6035e62e151b414c5e3075ef239c29b57e53df6832b8ede883b085dd756e1730f3aa73a80901cf99d45109d54e23deb63b0e396f366ab89ed158b97c1803de2d33526fa4b46937d74d6ee0eeb7f6b082f66608b18e2792f93735571322f0afefa8f8353fd3fb393636ae891e5e4ffc76bc30a8f1ac31d7075679f1980ac6b63c088b96446cca4b6911d7c414064d2c6c9476b59b39942e8618463cc6f238982c63adbbb2ae13b65d2b936beefde9984620435dbe30b8e133c9dd4c5695fcead946f54e6ada8f63d903ccdc6ebb75dccb046069119070354062c8e92d7d582638ba798a6164fdb69f1043408a6b2486ee6bf5a8496bd3433a76f1e22a7e8e9f48a02eb4c81133b199f5c46fe6fa1111b94359bf0ecd6af172f7af48f5c6ddfd78ce38a3e519e715476913c41dad8aeae84651bd38cdf2fd6b22e932a0d1cdb97faadf0e491691bc0203c82a912296f7908a3ff3fe1a0bc89a80103159b4ab618ed8fb02a3e2fd336242ae2c0c3340c4a2018c2bfbb9db956dc6f96b37492ee432215448a6aecb591ae3c54c3f056d0308d6dad8e55be1c7d15fa06e6dfb58f44722f6097d25f241f79398c55b8f25103ebb919f912379b93d615d1b73ec26fa8bb562839e31ed2e26899ce521fcfadc07da15697212cc81458cf63ad2d2f096c5c6ca70d74960252f2a034586e5612efd63faf4be7654812036c78ad4cb470932942a41d1f1f0ebe154e42d20e00bead7cd5d80619d005456d2f1f3092a6ce9338556ca09ef66a67a0a4d4c4601bf50b29ce01ab598f085ee716419cc7cbfe0d7756284638e28f25d177e189e59010c4c600a42fedf2b97aa498cfcdfd8536458c5706d09195b5827cbf5ff55f5de60dfe2b763345bd0e6b713c88ba27b4b70b84d743535fc89756abed0cfb95a28e51f415bc37f11666a2b739d416542e49b365b467e8d4f92b9143f408e2563acdaebae2ba897a5b8ec792ceaabe84c3f15b836f1d1738c5dafefecea7b79c2e89cb6bb5e532fcf08f5859f7a34efe8b236e492705ad63d5e36921c500b401fff5d2b3b7c66aa6b77e73e7667c937bf7d8d91ab1faca2d12db1adb3a2b588bd648d2976f1e9728ad223b5bfa13ac31ccbe430cd1cc85bf100da5822ae5faf7f0638ee94ee685a7a24a70842f37aca9f28f80b2c26427eb24f909631b2ee84f103ae4ccd1dabf037d163694efaa9962df849ac7a14d2543290c58c6eb972f6f0e90da7b2857f3a730bce4fd614ebc633f3562f18869c7d1c711850cbd8e5382d6534b70a0bac0227f9f49753f070a08613a78fff50a5da11cd696df39e2f63fc3a7426764e449999172d3925719a42d0c53ab2e7b0cf8b95d91a2e2759f7df2810e2164561ec8a4f22ca76e95722c5a7a71bbe0b040402fa2923d94aecba395debbb0cbe6a56b5b8042f96328abe069814467f2144f98c9cad6e7ad63cc3595dcfbb49234bb1d01b8b6b130ace15a2aeb8ef428cf98f1a60b9f8ac51a4c236bdf8d2bf46368eda287246664e5c8132a016cbfeb904c6b1bba054d20b887a602bcd265c0520e4b9d33370c65dbc86bacbfb3542770eef9ce023b3b74d7c1a8aa117d0170afa766f5487e7977e62c39d63da1d92fd7c8e6ea11985d99d235bed8583a5f210323b356ea26089b4e4a562f80e3da9198e6f3b2b1a570c166c8fc9a293600799424e8406a877b3f9ef7d07b760933a97e4575ef5f23ef92f24c6902131a41c6a4ae52b5b7c902ef6b2fb732b99c8308a7a96e814c48c8846b8117ced8cc75c19ce841669645496768b51fd1ef92216533df8a54871196fd6c1b022b27300f4abc9dc9f4488269b6582240f987288f13af4be3d2dcb7a57fe8548d88b4b6faba0df285f22563e98278694aae9f3dd642fa10ccb385e0563b7599da131fd41077b20ae3129a2deca3ad5c039ddb95fd27bb2c3b6e685e023681344441f5925ac3360817a6e04d87258883f365686489d33d35667702fdf0a46de1243a39bc8b18166d709934922c7cd18edfa167e8fd11953b1ed85fe38913ba3699765a65a0ac7c57ea60d8e83a606c003bcc2ec3fda1c6c968115cb35e66c6ce66ef1c50845bf161fcb69c342150e1bebf9837860bca307c8019d73cc5b06dceb28d96050d23b377cbee2095ce079b6589890951bc6acbea995e3d2d24835a5ef4e38921f986497d691bd75ab3ee1710481e7ed26e7a47a5572785fb74ef45c624c207b89ce53267f0d60f84264ae204bf07fa7097ab0a5e22389462f8985e2c0f196a4009ccf8656c5d068f438ee756035b6787d624b74ac4bdf981cb506fd2e1d099802821d2c82df415198eaf27eb5f3fc0e9cb1a5c37ae13367b029171bbffd2f29458fd3c2ad7edab7962e67c810b2596e9a82b5471792a9e71c2d50477819c83cda95f2fd0c8521f5c5954ec25d35929be8d119b6625fcac045d123214ba4d492034ad592dceb08fc63b349300a4a480e5706c24e85c1e4ee9ddf386a09707d296a71efde3c36a3fdfd8040ab3ee336160a6a61aa72a8d83a15724d0980fb2bf09db509fb42af3e5b85cc38b3ada7aecbccb67dbcf5cb83fc6fdb63a80125b28b0a90328aa6b0ee088ead00efcf8de5e9ab1448e90f93d2ed81891cc09c397c4704234934bb4b87dedda615d6dfdeebb8bb53d9c82b9e36ead8caf99e9713a9b66c282c2813f1d3053381372a0dc690928a3c77db6ab0aabca996703b56413f6cba3d91cd239d3772ffd8afabc6a9f00d8d7530e08ee6dce01a4d88046a42af9a7515a26479403587b25602108055d2270e5647b5b3f30a01182da993067c8eb7471c319a30d163a2329e5a6358a12a1c30371d2bfa4d1be707aa915b73ade611bfd86c9957190a07b66af726641fef0dfa83c4a1cbc235dc8e3924a943a4899121d130e05180365ce01c3350c643e76bcab921a07d587a7341f2381f219e6cb6118bcd9c875f8fc5117df64ea2859d1348ad98fb8b4324ba64948aec18a9ed36bce64bc5a8f19c2ecdfb4075582dce980eb1e1f2ca9f1e5a26124c042417700a511febb059e814e229ba3cfd1f7f00cf9e11a3829b8c518a5327de99772e411a60dd63f7e9cba8ed2058b6bb2bd6e848e76be373f1ace367fb84ba709d5d4ef1a95dfb86a55f4fd01808c3e93a20ba2dfdc18a4faf58d8523cb854312e89eed5aa2b83ca94f545a2ec0bac5f86038b2b69ece0ac7b633814cc4ab91a6088ca70ab04facbaad504b1166e72a20dcc1c81947520832b0001263506b1703f2d5cc9a2ed81d026ecb7fa72dcfb82dfd53f72623b88923f1b407b2e033d7ef59ad6ebb6a04cfe8b8554de268a2242696aadc4bdd3da535d6c4d2da549e7ffbf20", 0x1000}, {&(0x7f0000001540)="378bd4322f40223ba440c9cf4fbff8a01e91be6d802bb2a11b04c070831d6c4e17ac24a108fba4265fc5f9acd3e33cc1cedce17cdde483bd8c623d23d20a0a60d19b49338994df385417ae275d18ec2ea9c7728abcb82a763d1853f5a81dec6b30a09fbf788bc00d105b994e8816094482252625dc49289b12a65bfce3d727552aea9e40", 0x84}], 0x2, &(0x7f0000001640)=[@op={0x18, 0x117, 0x3, 0x1}, @iv={0x90, 0x117, 0x2, 0x7a, "3fb1ee395d4602a0c56f4669faba0349b3d638ec7cf580c3519558e5dbe488b286b51eff9e72dce5bd67929636d999c46188b37d381631c612546a20e9a234c330eed0281b7001ff6d8d868e94d5b864a3be731a8866962020b70622d3cc474ba66d5c88b8e696f0507c6c9c296d316c687304979d704c1faf2d"}], 0xa8, 0x80}, {0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000001700)="cf5b5f4e836d59e0e1c9d1fe", 0xc}, {&(0x7f0000001740)="dd0cced56bca0458efe82670b72a7c1c7b3c975f7ee798188af4c88e6b64400ba3f501b4db05c2c0e553b8f8cc278c5744f974c24130571594d4d37a6f6f6327ea8625b7b27180c4412c9d4d236a3fded3b2d35a1580b1be93672930337f0e39be72e2d810c6dafdb37638f9ac852a920db134b20d5a9039d97c567519f1b9232cd147f01872d8880e56b24c6eabb02d1ad1bda7ec92dd11423fb6e0628ae70157ce26c3", 0xa4}], 0x2, &(0x7f0000001840)=[@op={0x18}, @iv={0xa0, 0x117, 0x2, 0x89, "f19db3c46cd16945bbb5e8fe96a3b4372a08d3dadbd47af6048b99f6736f40511c9cb78bbdd4a3c71eea90620a1d9f761c4f5884cafb5bf3620cd110e2bcad99326d8fa90b490daf797b79cf960d1800434e627eac57e22d59accb421c51633efe7f1f0b100c536064da43a588726e43afd1fba2c7baa1e85245dc47c8a2e2c9d08e39483fe9b39b25"}, @assoc={0x18, 0x117, 0x4, 0x1}, @iv={0x70, 0x117, 0x2, 0x57, "cd79809eb58b107f170d35f36538dcf08fda8ca1297723f49e308f434a71c4733a83f9119853c15494fb54360511af5df3bd7bff45153398e5081347d442df0fbf7146064c6134b8a82607251de7a4ad724ea30f5f440e"}, @assoc={0x18, 0x117, 0x4, 0x2301}, @assoc={0x18}, @assoc={0x18, 0x117, 0x4, 0x1ff}, @iv={0xa0, 0x117, 0x2, 0x87, "66312af3e0cd1e8490d4c640903ebfc60c4fa988384f326004d72efa209e912f76dbf70d3722d71abc74d102f12e728a04f2d5a307b3546618b342753eefa551fdd26e57223dd740b1ca9f6847bc5672faba210ce1227bd4c2cee599b93941dc31321e8a991c58e19be6335ad7f20ac7e1bdf23a9476a273801be0667955b9baea1d2d835bad50"}, @assoc={0x18, 0x117, 0x4, 0x6}, @assoc={0x18}], 0x258, 0x8080}, {0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000001ac0)="649a6467639cd5e0ec39f96a5ff8d606f1487780cd9ca8610cf37c7be48656fffb74eee1ef771a589080ebdade89c3e3a16951bb00e9bf2fdb4ad8f47d39c00c14fccf3753b8e508477cb9494c7dfa81948d4bcc98f8735ac1d0c4d25b2212c7aabd2a0cf7edc181f899f2f8ae5b44b7f55b15c125a30ccbf094f981434aff3a3dc4ea581a01de3a46aac39add5384703a8f4b53a3ad3efd5094afa3cbca844f5fda22b81fc4924bf44632785af2f855a1", 0xb1}, {&(0x7f0000001b80)="55a1941aaaead4e09c30f38acd45470fae7f8ddd4a673689aacc7c3c6e706ce5040dfa5f14135d6c35dda7c9174426649948b00e373dc05e107eeb8318cbd60942a1f87eb7a1b29f0ae094361ecf06bcc0ed9e", 0x53}], 0x2, &(0x7f0000001c40)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0xc0}], 0x4, 0x20000000)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:16 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x20000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:16 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')
sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x5c, r2, 0x320, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xffffffffffff104e}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffffff81}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x20008011)

10:12:16 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
pread64(r0, &(0x7f00000001c0)=""/217, 0xd9, 0x0)
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x80800)
eventfd2(0x5, 0x800)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000140)='\xa9&system\x00')
ioctl$KVM_GET_EMULATED_CPUID(r1, 0xc008ae09, &(0x7f00000000c0)=""/9)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(r0, 0x6, 0x15, &(0x7f0000000040)=0x5, 0x4)

10:12:16 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x40000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3367.638000][T25103] FAULT_INJECTION: forcing a failure.
[ 3367.638000][T25103] name failslab, interval 1, probability 0, space 0, times 0
[ 3367.728749][T25103] CPU: 0 PID: 25103 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3367.737825][T25103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3367.747884][T25103] Call Trace:
[ 3367.751184][T25103]  dump_stack+0x172/0x1f0
[ 3367.755529][T25103]  should_fail.cold+0xa/0x15
[ 3367.760137][T25103]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3367.765989][T25103]  ? ___might_sleep+0x163/0x280
[ 3367.770854][T25103]  __should_failslab+0x121/0x190
[ 3367.775799][T25103]  should_failslab+0x9/0x14
[ 3367.780307][T25103]  __kmalloc_track_caller+0x2d5/0x740
[ 3367.785691][T25103]  ? alloc_vfsmnt+0x28/0x780
[ 3367.790305][T25103]  ? kstrdup_const+0x66/0x80
[ 3367.794911][T25103]  kstrdup+0x3a/0x70
[ 3367.798821][T25103]  kstrdup_const+0x66/0x80
[ 3367.803251][T25103]  alloc_vfsmnt+0xba/0x780
[ 3367.807682][T25103]  clone_mnt+0x71/0xfe0
[ 3367.811857][T25103]  ? kasan_check_read+0x11/0x20
[ 3367.816723][T25103]  ? do_raw_spin_unlock+0x57/0x270
[ 3367.821849][T25103]  copy_tree+0x3ad/0x940
[ 3367.826111][T25103]  __do_loopback.isra.0+0x177/0x3b0
[ 3367.831327][T25103]  do_mount+0x163c/0x1c00
[ 3367.835672][T25103]  ? copy_mount_string+0x40/0x40
[ 3367.840625][T25103]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3367.846876][T25103]  ? _copy_from_user+0x12c/0x1a0
[ 3367.851831][T25103]  ? copy_mount_options+0x2db/0x3f0
[ 3367.857040][T25103]  ksys_mount+0xdb/0x150
[ 3367.861324][T25103]  __x64_sys_mount+0xbe/0x150
[ 3367.866017][T25103]  do_syscall_64+0xfd/0x680
[ 3367.870535][T25103]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3367.876426][T25103] RIP: 0033:0x459279
[ 3367.880322][T25103] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3367.899929][T25103] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3367.908356][T25103] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3367.916334][T25103] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:12:16 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)
syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00')

10:12:16 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7fff, 0x0)
ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f0000000040)={0x2, 0x1, @value=0x3abb23ea})

10:12:16 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(r0, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3367.924312][T25103] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3367.932289][T25103] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3367.940271][T25103] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
[ 3368.023817][T25185] device nr0
 entered promiscuous mode
[ 3368.058369][T25256] validate_nla: 8 callbacks suppressed
[ 3368.058380][T25256] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3368.418548][T25466] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:17 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:17 executing program 0:
recvmsg$kcm(0xffffffffffffffff, &(0x7f0000001900)={&(0x7f00000001c0)=@pppol2tpv3={0x18, 0x1, {0x0, <r0=>0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000001740)=[{&(0x7f00000000c0)=""/48, 0x30}, {&(0x7f0000000280)=""/123, 0x7b}, {&(0x7f00000003c0)=""/165, 0xa5}, {&(0x7f0000000480)=""/134, 0x86}, {&(0x7f0000000300)=""/39, 0x27}, {&(0x7f0000000540)=""/232, 0xe8}, {&(0x7f0000000640)=""/236, 0xec}, {&(0x7f0000000740)=""/4096, 0x1000}, {&(0x7f0000000340)=""/55, 0x37}], 0x9, &(0x7f0000001800)=""/252, 0xfc}, 0x40)
ioctl$SIOCX25SCUDMATCHLEN(r0, 0x89e7, &(0x7f0000001940)={0x8})
pipe(&(0x7f0000000380)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
ioctl$RTC_PLL_SET(r2, 0x40207012, &(0x7f0000000000)={0x6, 0x7, 0x25fa, 0x5, 0x8001, 0x3, 0x4b})
write$cgroup_int(r2, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r4 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r1, 0x0, r3, 0x0, 0x8100000, 0x0)
ioctl$LOOP_SET_STATUS64(r4, 0x4c04, &(0x7f0000001e40)={0x0, 0x0, 0x0, 0x8, 0x9, 0x0, 0x3, 0x3, 0x1, "2229dc8ff2e6a3e598c64b90be4f3c4aeacf783110d31b3f11c8d6671069bafb176c00d85c6f3a0787892a2b2e5c3e67454b7da57f1094b3fb9ce86f66ed4743", "9256c2398012b570fa179fbfaa1e1b38272c81881cbe55968effbbfb3e2bdaaa1c4640c7ce4921988b51055a695d7e443bb05c852df8cf2d213cee5cd0b12453", "1d6ae5c061b134bdaf90d819dd4fd9240acb7fcc7747b59688a052ec1ddc399e", [0x6, 0x101]})
write$binfmt_aout(r0, &(0x7f0000001980)={{0x10b, 0x80000001, 0x7, 0x1f4, 0x39a, 0x3, 0x2aa, 0xcb}, "666fe907faf5b3828854eebf91b0c65219b7f0ec3856a6fa26b238dd246ad462057166a3ca398f032687be573d2d731c457e6c13c0ca66022f38acc9e358b2c1fa11865a7369a170d1502208a3fcd37492b3a2d2b2985bc48525ba282d1e1023628c0028c806539137698468976717e2379f4d2f2833b06d35c4", [[], [], [], []]}, 0x49a)
r5 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x1, 0x2)
setsockopt$inet6_MCAST_LEAVE_GROUP(r5, 0x29, 0x2d, &(0x7f0000000100)={0x7f, {{0xa, 0x4e20, 0x8, @mcast2, 0x1}}}, 0x88)

10:12:17 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x4000)
setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000000040)=0x68eb88492e28405d, 0x4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:17 executing program 4:
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

10:12:17 executing program 2 (fault-call:5 fault-nth:38):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:17 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x48000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:17 executing program 4:
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3368.591161][T25510] FAULT_INJECTION: forcing a failure.
[ 3368.591161][T25510] name failslab, interval 1, probability 0, space 0, times 0
[ 3368.623062][T25510] CPU: 0 PID: 25510 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3368.632141][T25510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3368.642216][T25510] Call Trace:
[ 3368.645535][T25510]  dump_stack+0x172/0x1f0
[ 3368.649887][T25510]  should_fail.cold+0xa/0x15
[ 3368.654506][T25510]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3368.660345][T25510]  ? ___might_sleep+0x163/0x280
[ 3368.665341][T25510]  __should_failslab+0x121/0x190
[ 3368.670287][T25510]  should_failslab+0x9/0x14
[ 3368.674810][T25510]  kmem_cache_alloc+0x2af/0x6f0
[ 3368.679674][T25510]  ? copy_tree+0x535/0x940
[ 3368.684106][T25510]  alloc_vfsmnt+0x28/0x780
[ 3368.688531][T25510]  clone_mnt+0x71/0xfe0
[ 3368.693569][T25510]  ? kasan_check_read+0x11/0x20
[ 3368.698461][T25510]  ? do_raw_spin_unlock+0x57/0x270
[ 3368.703581][T25510]  copy_tree+0x3ad/0x940
[ 3368.707848][T25510]  __do_loopback.isra.0+0x177/0x3b0
[ 3368.713069][T25510]  do_mount+0x163c/0x1c00
[ 3368.717415][T25510]  ? copy_mount_string+0x40/0x40
[ 3368.722370][T25510]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3368.728620][T25510]  ? _copy_from_user+0x12c/0x1a0
[ 3368.733575][T25510]  ? copy_mount_options+0x2db/0x3f0
10:12:17 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:17 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0xcbd2, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000100)={'veth1\x00', 0x4800})
openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control\x00', 0x141000, 0x0)
openat$vfio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vfio/vfio\x00', 0x8240, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60)

[ 3368.738792][T25510]  ksys_mount+0xdb/0x150
[ 3368.743052][T25510]  __x64_sys_mount+0xbe/0x150
[ 3368.747747][T25510]  do_syscall_64+0xfd/0x680
[ 3368.752269][T25510]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3368.752282][T25510] RIP: 0033:0x459279
[ 3368.752298][T25510] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3368.752314][T25510] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
10:12:17 executing program 4:
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3368.781693][T25510] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3368.781703][T25510] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3368.781717][T25510] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3368.781727][T25510] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3368.781736][T25510] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:17 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$KDSETMODE(r1, 0x4b3a, 0x7ff)
syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0xfff, 0x20000)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:17 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3369.022222][T25683] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3369.148322][T25685] device nr0
 entered promiscuous mode
10:12:18 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$KVM_SET_CLOCK(r0, 0x4030ae7b, &(0x7f0000000000)={0x3, 0x9})
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000100)={'raw\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$KVM_SET_XCRS(r2, 0x4188aea7, &(0x7f0000000040)={0x1, 0xcff, [{0x65, 0x0, 0x1}]})

10:12:18 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:18 executing program 2 (fault-call:5 fault-nth:39):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:18 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4c000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:18 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:18 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3369.509323][T25803] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:18 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(0xffffffffffffffff, &(0x7f0000000000)=@generic, &(0x7f00000000c0)=0x80, 0x80800)

[ 3369.549532][T25857] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3369.606221][T25846] FAULT_INJECTION: forcing a failure.
[ 3369.606221][T25846] name failslab, interval 1, probability 0, space 0, times 0
[ 3369.650471][T25846] CPU: 1 PID: 25846 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3369.659562][T25846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3369.669634][T25846] Call Trace:
[ 3369.672946][T25846]  dump_stack+0x172/0x1f0
[ 3369.677294][T25846]  should_fail.cold+0xa/0x15
[ 3369.681915][T25846]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3369.687745][T25846]  ? ___might_sleep+0x163/0x280
[ 3369.692614][T25846]  __should_failslab+0x121/0x190
[ 3369.697576][T25846]  should_failslab+0x9/0x14
[ 3369.702097][T25846]  __kmalloc_track_caller+0x2d5/0x740
[ 3369.707511][T25846]  ? alloc_vfsmnt+0x28/0x780
[ 3369.712126][T25846]  ? kstrdup_const+0x66/0x80
[ 3369.714528][T25871] device nr0
 entered promiscuous mode
[ 3369.716734][T25846]  kstrdup+0x3a/0x70
[ 3369.716753][T25846]  kstrdup_const+0x66/0x80
[ 3369.716777][T25846]  alloc_vfsmnt+0xba/0x780
[ 3369.734956][T25846]  clone_mnt+0x71/0xfe0
[ 3369.739139][T25846]  ? kasan_check_read+0x11/0x20
[ 3369.744156][T25846]  ? do_raw_spin_unlock+0x57/0x270
[ 3369.749291][T25846]  copy_tree+0x3ad/0x940
[ 3369.753566][T25846]  __do_loopback.isra.0+0x177/0x3b0
[ 3369.758788][T25846]  do_mount+0x163c/0x1c00
[ 3369.763144][T25846]  ? copy_mount_string+0x40/0x40
[ 3369.768102][T25846]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3369.774367][T25846]  ? _copy_from_user+0x12c/0x1a0
[ 3369.779334][T25846]  ? copy_mount_options+0x2db/0x3f0
[ 3369.784558][T25846]  ksys_mount+0xdb/0x150
[ 3369.788817][T25846]  __x64_sys_mount+0xbe/0x150
[ 3369.793520][T25846]  do_syscall_64+0xfd/0x680
[ 3369.798058][T25846]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3369.803984][T25846] RIP: 0033:0x459279
[ 3369.807900][T25846] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3369.827522][T25846] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3369.835956][T25846] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
10:12:18 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x60000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:18 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x100, 0x0)
ioctl$KVM_NMI(r1, 0xae9a)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:18 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmmsg(r1, &(0x7f0000001080)=[{{&(0x7f0000000140)=@ll={0x11, 0x5, 0x0, 0x1, 0x3, 0x6, @link_local}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000280)="34a1815ed7d9d2801330b41b3c8553b3ef438f865a711d5210aaecd9cb259aaa4adb85cff22e4955306bd21747331fc69e095f9cbb07c3cce172e3c8b94b0501896dc0de59b67eba3ca53d2669a557d9838963ea609c86fb5cc307470286ddb00b866b207c4d0bd572236f19db1ce84fb32414f2e89da587722a14afeb621c8946dfd99f89e561", 0x87}, {&(0x7f0000000340)="8f50b04b117a251a75194146525d02b3ac247dc2587701db5dc9e2dd6ff437a3c78a7134ae0f07f116cbc575bc75302f4e7dc885d306880c4e172eb75282fdd4bbc4bbbf59052b517c23252c3d31072ea42cc0e53288789a2736d6b889ddeeb5ed567833a41ee5de781ec75d3d924f2cbaae580e2bc034e2e0977bac6e33239ec57e0a21848ec69be7ccdc7d58e214c62b5004acec40fa32733a9dedc7df8c91bda14ac63d3a6af4faa1081a5bcbdd4c2928add533dac2dd353a47d84e0494afbc0461459c0b5bf3ca3e239466db3f699e0c548ae24636533a", 0xd9}, {&(0x7f0000000440)="334418c6a9c8a9b3ba9a609b5f84fdcc2630df3da33c9123d17ed75376010fc5d6432bc07ef0cbe5f29496a3af3a2f839056ed9d2a7db79d96443714545f665f7dac90e6afc19b8a03a5531e312315601265f1343a6506ad2609bcf7ab7bc483048ed71f209f13f759483db7c4e3569dde2f3ed8f253346332db1f800e9dbb5a01d2cd0849d9840e1e0792b0459b206258c58e96ef82b757126383436e29a41d7d1cdb2ac7f70a32206444ed8ecbceeaaed2e18e5664d038337a639e60607897e8f650b5a8ccee820d1445072c9bd0943897", 0xd2}, {&(0x7f0000000540)="60871870d1c8b94426cdc84d4874c3ced14304501aa3ee580a4c0bc1e4418890b35b93cdd0addc52a217f514790bf385db92a73dd289c5d995f95b2544ef049f74ee435e0576e66b51b24721569bb254eb6fb0ea708837ef3208d391b7b60f89383cd1e67c01568209f0ae3ecdfb2ac493220e7619cd9afeb4fcec5ad970982eb247783b0e2cbe3ead7021358489614d1681eefcda2dd1e994186a0a77b9ecce0b0130809f2817564dc9b713a809ce28a29f46dd58f695994fe40eb70385", 0xbe}, {&(0x7f0000000600)="9cdd8620e2ef7a287890568f68552160b766661954990e349f6193ae4b2aa8907dde38a9719305bc83206daca79d531124293d5ecce0c2858db6c9f024f4e269b2200a86ae6d3d02545a72274c237236932c3656af41d80c840b5b9c742e7127df6ec585fd8485d3b6bb3ee48307069bd4e021946c94a92f1f70d82940374489887ee83804fcff7783c13bb1d6aca5e93b2b7ec8f97087746b0e12fea2c5da02c1a28bac4dbe72360b56d825677313ea7ed8dd4270cc94a59d57897d379a37181d0554ad6d08", 0xc6}, {&(0x7f0000000700)="303172a01961d76602139baa8b423c79975215c22c9ddf3a536dd42da4d2f959efae363837dd9af0f4c41642d85186d15a0e0145334ce03f368b146c4af500ae62bb48ea353bc8519f82d93f141390888bf648c4a3bb270ede6f23100014d3b7a3ef6ace6bc9bb87d627766135765b5a6150ab8599f1887456055ddfda7e7ee08f8997f96dce", 0x86}], 0x6, &(0x7f00000007c0)=ANY=[@ANYBLOB="d00000000000000039010000020000003ca62a8ea58fb9991e6b7c29022737c73c257c59ffd209728b5053be658d2073d96cd6d3085a8433ccf521c6086629dfe904320c96932e403198d00cbc5870cd940c2d01abfd46823d97553cb95686c271961d0711bd2f9ba5c8be42cc3b1aaef7266f7d4ba88a1ec26eac9bb2d09571bd75c9c05bd7dd72469d1c97ab7420763f8e4f1bc408898115dcf5839aedeec716170c8f24c3f60c1cd7dbcdeaa76445c16f196cd770c66dc4e142340f280a2b0ac76feeb54f58af6bfff1ed09000000d800000000000000000100001b7d2b5e83b1be0f80a912b93d160bb89df5fa952d3dc21ba8579d76cbec08764f8db78340136e095a7aad3b90ce52affbf3792a628c97920f1126346a44fef10a8cb11c81efbc3d8856df9d5d91f5bfe453a8520addbcb172616fcca35a9206009d7748d3ca2b1134bd1dc152b653161c429b7d34ec2a7fe3a59340caa0593801ad885a491b609855cbb43398768ccc96bab320797e7a80b0bf21b492fb4f0e765c33e427c04d74dc11cdb547fd47a994dcd972be2100"/424], 0x1a8}}, {{&(0x7f0000000980)=@pppoe={0x18, 0x0, {0x3, @remote, 'netdevsim0\x00'}}, 0x80, &(0x7f0000000e00)=[{&(0x7f0000000a00)="959990", 0x3}, {&(0x7f0000000a40)="d8af1bd110b47e53e232a5100ed859acedf14919e092016a7f", 0x19}, {&(0x7f0000000a80)="60a46323e4744362bc61d1a786211e7bdc4542f04e8654285839d9ba3b1b03d3d1ac47f1f39083dfe541c7f4ee1debf853e0343767bfb01fb828df3e559a216f4f8ec68d7ac659661b46e879d9c448e07d454dee860ac6d7311e9f41a50ce604012b1206ab3b0018d0e5687b0aaecd277fde2a2b547a81090b7a13d3a235c4d796cdae4e60e7056f4601e37332", 0x8d}, {&(0x7f0000000b40)="f2f8ec28ca887ab35436a4dc99994980a1e13a6a5946e8f19bcbf3d7731d87cf1d08dab0f2775f", 0x27}, {&(0x7f0000000b80)="047437e407a123988d8b6603a92313e114eab896839dbbfad1e85393dad8d40d7142cadd36432adfda492b7579e00f3f915dc7015a1b5b014abf20e96c4a6cb67d3c95ae6ebf", 0x46}, {&(0x7f0000000c00)="c829399ad438a301ae05316a54fe1d1a2ce4404b20d503ffed3f32963ff21cd3920b138edea96e16cf3dd609f19ae8c45481185379eb0218a3c1d9c4503e14504ea43f2f778c7d09227264c22b9b5955357c3016b2158745da66e20073c1962dd02f12b8746eaee023f3631c66ae13e54f1cb6f39e0eca7a96b8ccc9767f1c55f5175df0d197c3fd53e6113e1e5144083f1db2960062bf2b4500c9a47039182d576cc97a8540065325cc55d7d1d6807e97fb4e05cd45431efeb530cefa308cd57d0b8522a473818fd8e863f53c5fea841e8c786ad088083397c2488e0ebb7c4d883b6ab01c7452425e6c4ac0dbd76aaa7aa2637626686a89acbd5f5726d0", 0xfe}, {&(0x7f0000000d00)="4bec8027fe8d2ffcb7165e2de17399f918c819aff200958fca7a0d7b21b46417738dd427fa47c120cb128fe10d0e459d0ea5a190d8b2f85ed3d36f99a53c019d039ce9642e6955fad566e9d32898c13d40ed59100a8de888bb31f222d0fe7c39a9bf93d213e72fcbfc855ddcb804867c57843a11ae48681b3ff736ee13f504d8e0a096d8dfd5be68b3a4c41c56b454bcb5c87ca9f9770252ee07808dac18d283067619b2464b39040a48aa21b58606b36132a1aba3e047f832b25ad8fde9862ad3", 0xc1}], 0x7, &(0x7f0000001140)=ANY=[@ANYBLOB="f00000000000000029000000090000005bb729f88c8e2e1e8654320dac3a8c0a0e39e40591e8b1d16b7c65a924708106a7a41811b61d0553182fdcf8b6ca61bd11d503c08b5512f25b41fcca452e742eaa3f8c38abc2896e020167e0beb882c66eff00fcc2ec2c9006eb4d254d17c876f39db7ab4e66a9356c8a8cfd0155bac1e75871128785b1cf6a0fc05f2defcb9beffc218770e6561aaca6eba94326a8d92661eb77dac192b30c3beeba2686f03fea2a607af5e068d513d56efd92c550f98c979290e562e47fc417a6f148e9d1d6d74986f0341a81daf878804277f50331a602f8fce43f0826030000000000000068000000000000001f0100000600000036c61aa70f5983043f5c4e1908ece239a3e0c69a75a02c4377f576f8d76a2e51cf86e85e26f11cda3a374bca8cd0134d56979c914b70fdb07c2f4e94a99934fe10e18b3b5e0ba63efb32cf88a1e23ca8d151c6589a5500001800000000000000ff00000005000000284a110000000000800000000000000005010000faffffff4a8d8b7867927435c39dad96b45bd244c37cd8215c6adafc77caf7d6bedd2c256b62fbd489aeed1b5816cd1fb654bf5a35b1470e0798e5e34aa85d010871071b732079b39089b492489b0668c7a2a7a5a4029eee4e1cdab09733a0818d74d25f3e29a53731753b967822eb79610000004ed896aa01bac5d9704a309fe760438236df3e539f71ae8ca7858a69667bcdb89b0b481339067985e619bab82d20d7a0886ebc5e30e79605620525a62f931c601864dfb12847d10735627ae9db8d8e3f61bdf32b54c3ada0209a3efa6e23862a9ba0495c55e1134d2a826a9ac2e9f3d09107e7e5b2881cba8a38761b731d3ba0bd19bb7e96c154"], 0x1f0}}], 0x2, 0x80)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$EXT4_IOC_MIGRATE(r1, 0x6609)
close(r2)
ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000000)={'ipddp0\x00', 0x600})
r3 = getpid()
r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000ec0)='IPVS\x00')
sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000001040)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001000)={&(0x7f0000000f00)={0xdc, r4, 0x410, 0x70bd2a, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x10000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xffffffffffff4e34}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xa40}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e23}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xffffffff}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x2411}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7bb2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x36b}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4840}, 0x804)
ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000040)=r3)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000001100)=0x5, 0x4)
ioctl$KVM_SET_VAPIC_ADDR(r0, 0x4008ae93, &(0x7f0000000100)=0xf000)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3369.843948][T25846] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3369.851939][T25846] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3369.859969][T25846] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3369.867961][T25846] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:18 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(r0, 0x0, &(0x7f00000000c0), 0x80800)

10:12:18 executing program 2 (fault-call:5 fault-nth:40):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:18 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
socket$alg(0x26, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x1, @bcast}, 0x1c)

10:12:18 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(r0, 0x0, 0x0, 0x80800)

[ 3370.181014][T26228] FAULT_INJECTION: forcing a failure.
[ 3370.181014][T26228] name failslab, interval 1, probability 0, space 0, times 0
[ 3370.194391][T26228] CPU: 1 PID: 26228 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3370.203446][T26228] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3370.213516][T26228] Call Trace:
[ 3370.213544][T26228]  dump_stack+0x172/0x1f0
[ 3370.213569][T26228]  should_fail.cold+0xa/0x15
[ 3370.213602][T26228]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3370.213627][T26228]  ? ___might_sleep+0x163/0x280
[ 3370.213650][T26228]  __should_failslab+0x121/0x190
[ 3370.213667][T26228]  should_failslab+0x9/0x14
[ 3370.213683][T26228]  kmem_cache_alloc+0x2af/0x6f0
[ 3370.213699][T26228]  ? copy_tree+0x535/0x940
[ 3370.213729][T26228]  alloc_vfsmnt+0x28/0x780
[ 3370.236580][T26228]  clone_mnt+0x71/0xfe0
[ 3370.263808][T26228]  ? kasan_check_read+0x11/0x20
[ 3370.268678][T26228]  ? do_raw_spin_unlock+0x57/0x270
[ 3370.273806][T26228]  copy_tree+0x3ad/0x940
[ 3370.278167][T26228]  __do_loopback.isra.0+0x177/0x3b0
[ 3370.283390][T26228]  do_mount+0x163c/0x1c00
[ 3370.287750][T26228]  ? copy_mount_string+0x40/0x40
[ 3370.292712][T26228]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3370.298972][T26228]  ? _copy_from_user+0x12c/0x1a0
[ 3370.303931][T26228]  ? copy_mount_options+0x2db/0x3f0
[ 3370.309150][T26228]  ksys_mount+0xdb/0x150
[ 3370.313416][T26228]  __x64_sys_mount+0xbe/0x150
[ 3370.318111][T26228]  do_syscall_64+0xfd/0x680
[ 3370.322632][T26228]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3370.328532][T26228] RIP: 0033:0x459279
[ 3370.332441][T26228] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3370.352058][T26228] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3370.360497][T26228] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3370.368487][T26228] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
10:12:19 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
accept4(r0, 0x0, 0x0, 0x0)

[ 3370.376472][T26228] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3370.384454][T26228] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3370.392440][T26228] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:19 executing program 2 (fault-call:5 fault-nth:41):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3370.486058][T26114] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:19 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:19 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000000)={'ip6erspan0\x00', @broadcast})

[ 3370.553355][T26335] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:19 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000040))
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:19 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x68000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:19 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3370.707842][T26338] FAULT_INJECTION: forcing a failure.
[ 3370.707842][T26338] name failslab, interval 1, probability 0, space 0, times 0
[ 3370.758268][T26338] CPU: 1 PID: 26338 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3370.767355][T26338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3370.777434][T26338] Call Trace:
[ 3370.780749][T26338]  dump_stack+0x172/0x1f0
[ 3370.785131][T26338]  should_fail.cold+0xa/0x15
[ 3370.789749][T26338]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3370.795580][T26338]  ? ___might_sleep+0x163/0x280
[ 3370.800461][T26338]  __should_failslab+0x121/0x190
[ 3370.805417][T26338]  should_failslab+0x9/0x14
[ 3370.809933][T26338]  __kmalloc_track_caller+0x2d5/0x740
[ 3370.815372][T26338]  ? alloc_vfsmnt+0x28/0x780
[ 3370.820020][T26338]  ? kstrdup_const+0x66/0x80
[ 3370.824713][T26338]  kstrdup+0x3a/0x70
[ 3370.828624][T26338]  kstrdup_const+0x66/0x80
[ 3370.833145][T26338]  alloc_vfsmnt+0xba/0x780
[ 3370.837646][T26338]  ? kasan_check_read+0x11/0x20
[ 3370.842644][T26338]  clone_mnt+0x71/0xfe0
[ 3370.846839][T26338]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3370.852691][T26338]  ? is_subdir+0x28d/0x400
[ 3370.857133][T26338]  copy_tree+0x3ad/0x940
[ 3370.861409][T26338]  __do_loopback.isra.0+0x177/0x3b0
[ 3370.866630][T26338]  do_mount+0x163c/0x1c00
[ 3370.870989][T26338]  ? copy_mount_string+0x40/0x40
[ 3370.876033][T26338]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3370.882284][T26338]  ? _copy_from_user+0x12c/0x1a0
[ 3370.887261][T26338]  ? copy_mount_options+0x2db/0x3f0
[ 3370.892482][T26338]  ksys_mount+0xdb/0x150
[ 3370.896735][T26338]  __x64_sys_mount+0xbe/0x150
[ 3370.901537][T26338]  do_syscall_64+0xfd/0x680
10:12:19 executing program 0:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
fsetxattr$trusted_overlay_nlink(r1, &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f0000000100)={'L-', 0x7}, 0x28, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x925d, 0x200000)

10:12:19 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x200000, 0x400000)
ioctl$UI_DEV_DESTROY(r1, 0x5502)
lsetxattr$trusted_overlay_nlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'L+', 0x1}, 0x28, 0x2)
llistxattr(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)=""/154, 0x9a)
connect$rose(r0, &(0x7f0000000240)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @bcast, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0xffffffffffffff57)

[ 3370.906072][T26338]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3370.911985][T26338] RIP: 0033:0x459279
[ 3370.916003][T26338] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3370.934535][T26343] device nr0
 entered promiscuous mode
[ 3370.935616][T26338] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3370.935631][T26338] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3370.935640][T26338] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3370.935650][T26338] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3370.935659][T26338] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3370.935668][T26338] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:19 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3371.063828][T26647] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:19 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=<r3=>0x0)
syz_open_procfs(r3, &(0x7f0000000040)='net/ip_vs\x00')

10:12:19 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6c000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:20 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0xbc, 0x8c080)
setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x3, 0x4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:20 executing program 2 (fault-call:5 fault-nth:42):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3371.480866][T27116] FAULT_INJECTION: forcing a failure.
[ 3371.480866][T27116] name failslab, interval 1, probability 0, space 0, times 0
[ 3371.517571][T27116] CPU: 1 PID: 27116 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3371.526677][T27116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3371.536761][T27116] Call Trace:
[ 3371.540083][T27116]  dump_stack+0x172/0x1f0
[ 3371.544437][T27116]  should_fail.cold+0xa/0x15
[ 3371.549048][T27116]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3371.554863][T27116]  ? ___might_sleep+0x163/0x280
[ 3371.559723][T27116]  __should_failslab+0x121/0x190
[ 3371.564732][T27116]  should_failslab+0x9/0x14
[ 3371.569261][T27116]  __kmalloc_track_caller+0x2d5/0x740
[ 3371.574648][T27116]  ? alloc_vfsmnt+0x28/0x780
[ 3371.579262][T27116]  ? kstrdup_const+0x66/0x80
[ 3371.583878][T27116]  kstrdup+0x3a/0x70
[ 3371.587794][T27116]  kstrdup_const+0x66/0x80
[ 3371.592235][T27116]  alloc_vfsmnt+0xba/0x780
[ 3371.596668][T27116]  ? kasan_check_read+0x11/0x20
[ 3371.601545][T27116]  clone_mnt+0x71/0xfe0
[ 3371.605713][T27116]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3371.611443][T27116]  ? is_subdir+0x28d/0x400
[ 3371.615883][T27116]  copy_tree+0x3ad/0x940
[ 3371.620145][T27116]  __do_loopback.isra.0+0x177/0x3b0
[ 3371.625353][T27116]  do_mount+0x163c/0x1c00
[ 3371.629699][T27116]  ? copy_mount_string+0x40/0x40
[ 3371.634648][T27116]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3371.640910][T27116]  ? _copy_from_user+0x12c/0x1a0
[ 3371.645864][T27116]  ? copy_mount_options+0x2db/0x3f0
[ 3371.651090][T27116]  ksys_mount+0xdb/0x150
[ 3371.655345][T27116]  __x64_sys_mount+0xbe/0x150
[ 3371.660058][T27116]  do_syscall_64+0xfd/0x680
[ 3371.664572][T27116]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3371.670474][T27116] RIP: 0033:0x459279
[ 3371.674375][T27116] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3371.693995][T27116] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3371.702425][T27116] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3371.710412][T27116] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3371.718396][T27116] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3371.726388][T27116] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
[ 3371.734377][T27116] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:20 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000002c0)={[{0xfffffffffffffff7, 0x100, 0x7fff, 0x661a8b02, 0x80, 0x1ff, 0x3, 0x6, 0x4, 0x5, 0x101, 0x3}, {0xffffffffffff8001, 0x400, 0x8, 0x3, 0x5, 0x1f, 0x2, 0x4, 0x800, 0x7ff, 0xfffffffffffffffa, 0x6, 0xfff}, {0x10001, 0x7fff, 0x4, 0x8, 0x3, 0x9, 0x1ff, 0x9437, 0x101, 0x9, 0x401, 0x80, 0x3}], 0x8})
close(r0)
write$cgroup_int(r1, &(0x7f0000000080)=0x6, 0xfffffffffffffef5)
execveat(r0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000200)=[&(0x7f0000000040)='ooM_adj\x00', &(0x7f0000000100)='oom_adj\x00'], &(0x7f00000001c0)=[&(0x7f0000000180)='oom_adj\x00'], 0x400)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000000)={0x2, [<r4=>0x0, 0x0]}, &(0x7f0000000140)=0xc)
getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000340)={<r5=>0x0, 0xf6}, &(0x7f0000000380)=0x8)
getsockopt$inet_sctp6_SCTP_STATUS(r0, 0x84, 0xe, &(0x7f00000003c0)={r4, 0xf0f4, 0x100, 0x4c6, 0x0, 0xdc7, 0x401, 0x10000, {r5, @in6={{0xa, 0x4e24, 0xfff, @dev={0xfe, 0x80, [], 0x1c}, 0xc3}}, 0x51f9, 0x6, 0x3, 0x15c1, 0x2}}, &(0x7f0000000480)=0xb0)

10:12:20 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:20 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$SIOCGETLINKNAME(r1, 0x89e0, &(0x7f00000000c0)={0x4, 0x2})

[ 3371.807042][T26947] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3371.826369][T27169] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:20 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:20 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x74000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:20 executing program 2 (fault-call:5 fault-nth:43):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:20 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x280, 0x24)
connect$l2tp(r1, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r0, {0x2, 0x4e23, @loopback}, 0x4, 0x4, 0x4, 0x3}}, 0x26)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:20 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x4582, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000040)={0x4, <r4=>0x0, 0x0, 0x2})
ioctl$DRM_IOCTL_AGP_BIND(r3, 0x40106436, &(0x7f0000000100)={r4, 0x5934})
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3372.115897][T27198] device nr0
 entered promiscuous mode
10:12:21 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7a000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3372.233703][T27314] FAULT_INJECTION: forcing a failure.
[ 3372.233703][T27314] name failslab, interval 1, probability 0, space 0, times 0
[ 3372.294704][T27314] CPU: 0 PID: 27314 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3372.303801][T27314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3372.313877][T27314] Call Trace:
[ 3372.317193][T27314]  dump_stack+0x172/0x1f0
[ 3372.321550][T27314]  should_fail.cold+0xa/0x15
[ 3372.326254][T27314]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 3372.332103][T27314]  ? ___might_sleep+0x163/0x280
[ 3372.337157][T27314]  __should_failslab+0x121/0x190
[ 3372.342118][T27314]  should_failslab+0x9/0x14
[ 3372.346642][T27314]  kmem_cache_alloc+0x2af/0x6f0
[ 3372.351514][T27314]  alloc_vfsmnt+0x28/0x780
[ 3372.355943][T27314]  ? kasan_check_read+0x11/0x20
[ 3372.360808][T27314]  clone_mnt+0x71/0xfe0
[ 3372.364976][T27314]  ? __sanitizer_cov_trace_cmp4+0x16/0x20
[ 3372.370723][T27314]  ? is_subdir+0x28d/0x400
[ 3372.375166][T27314]  copy_tree+0x3ad/0x940
[ 3372.379444][T27314]  __do_loopback.isra.0+0x177/0x3b0
[ 3372.384660][T27314]  do_mount+0x163c/0x1c00
[ 3372.389016][T27314]  ? copy_mount_string+0x40/0x40
[ 3372.393981][T27314]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3372.400237][T27314]  ? _copy_from_user+0x12c/0x1a0
[ 3372.405211][T27314]  ? copy_mount_options+0x2db/0x3f0
[ 3372.410431][T27314]  ksys_mount+0xdb/0x150
[ 3372.414695][T27314]  __x64_sys_mount+0xbe/0x150
[ 3372.419399][T27314]  do_syscall_64+0xfd/0x680
[ 3372.423932][T27314]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3372.429842][T27314] RIP: 0033:0x459279
[ 3372.433759][T27314] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3372.453645][T27314] RSP: 002b:00007f8f12349c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 3372.462074][T27314] RAX: ffffffffffffffda RBX: 00007f8f12349c90 RCX: 0000000000459279
[ 3372.470068][T27314] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 00000000200005c0
[ 3372.478063][T27314] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
[ 3372.486054][T27314] R10: 0000000000005010 R11: 0000000000000246 R12: 00007f8f1234a6d4
10:12:21 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$EVIOCGPROP(r3, 0x80404509, &(0x7f0000000100)=""/180)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:21 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x1, @default}, 0x1c)

[ 3372.494052][T27314] R13: 00000000004c546a R14: 00000000004d9538 R15: 0000000000000004
10:12:21 executing program 0:
pipe(&(0x7f0000000040)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:21 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000040)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x1, @null}, 0x1c)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0)
bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={r1, 0x28, &(0x7f00000000c0)}, 0x10)
r2 = dup3(r0, r0, 0x80000)
ioctl$DRM_IOCTL_GET_MAGIC(r2, 0x80046402, &(0x7f0000000000)=0xfff)

10:12:21 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:21 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x9effffff, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:21 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000000)={'ip6erspan0\x00', @broadcast})

10:12:21 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$VIDIOC_G_FREQUENCY(r1, 0xc02c5638, &(0x7f0000000000)={0x5, 0x7, 0xb33a})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:21 executing program 2 (fault-call:5 fault-nth:44):
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:21 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x4, 0x100)
setsockopt$inet_udp_encap(r1, 0x11, 0x64, &(0x7f0000000100)=0x3, 0x4)
r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x403, 0x0)
bind$llc(r2, &(0x7f0000000040)={0x1a, 0x204, 0x5, 0x8, 0x754, 0x2}, 0x10)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0)

10:12:21 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf0ffffff, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:21 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

10:12:21 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={<r3=>0x0}, &(0x7f00000001c0)=0xc)
syz_open_procfs(r3, &(0x7f0000000000)='ooI\xcb\xee5\xca\x00')
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r1, 0xc0bc5351, &(0x7f0000000100)={0x1, 0x787c05bb0cc62678, 'client1\x00', 0xffffffff80000001, "226a3ea0d1060e75", "877f8766fc726e965512589a07bb4e40aaa9e8fe8b90466256dd19631ad126e7", 0xd25})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3372.932654][T27661] device nr0
 entered promiscuous mode
10:12:21 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:21 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xfffff000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:21 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(0xffffffffffffffff)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=<r2=>0x0)
syz_open_procfs(r2, &(0x7f0000000240)='oom_adj\x00')
ioctl$sock_x25_SIOCADDRT(r0, 0x890b, &(0x7f0000000100)={@remote={[], 0x0}, 0x5, 'vxcan1\x00'})
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)

[ 3373.353783][T27833] validate_nla: 8 callbacks suppressed
[ 3373.353793][T27833] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3373.380207][T27936] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:22 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:22 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bcsh0\x00', <r2=>0x0})
r3 = creat(&(0x7f0000000140)='./file0\x00', 0x0)
write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
r4 = socket$inet_udplite(0x2, 0x2, 0x88)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000580)='/dev/kvm\x00', 0x10000, 0x0)
fcntl$F_SET_RW_HINT(r3, 0x40c, &(0x7f0000000000))
lgetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f00000003c0)=@known='system.posix_acl_access\x00', &(0x7f0000000400)=""/207, 0xcf)
r5 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz', 0x3}, 0x0, 0x0, 0x0)
keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000640)={r5, 0xaa, 0x5a}, &(0x7f0000000680)={'enc=', 'pkcs1', ' hash=', {'sha512-avx\x00'}}, &(0x7f0000000700)="573ba874ecff4efded518efeb5351cb86f479779fb74d14fe34043989098da7ff8512c56703db97b5b8e946a6a7a78a542255c84bf65fbcf9daa4db07c041f1ba4bd0c2a65e5114dae39335153ea9ac25274e24b523bf07af1a5e5c37500a488922e7b86b3856109d2b5e871ca77edfbb2349a0a8958c980dbb766bc9001b9de57e5945ec35860869f3356f4f2828d552d1780ee99b72e4fa38a148a25dde3dea073d78a34876c4fa079", &(0x7f00000007c0)=""/90)
getsockopt$netrom_NETROM_IDLE(r3, 0x103, 0x7, &(0x7f0000000840)=0x28, &(0x7f0000000880)=0x4)
ioctl(r4, 0x1000008912, &(0x7f0000000200)="c0dca5055e0bcfec7be070")
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f00000000c0)={@remote, @initdev, <r6=>0x0}, &(0x7f0000000100)=0xc)
accept(r0, &(0x7f0000000140)=@can={0x1d, <r7=>0x0}, &(0x7f00000001c0)=0x80)
fsetxattr$security_capability(r3, &(0x7f0000000500)='security.capability\x00', &(0x7f0000000540)=@v2={0x2000000, [{0x97d9, 0x7}, {0x8, 0xff}]}, 0x14, 0x2)
sendmsg$nl_route(r1, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8101000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="540000005200040029bd7000fbdbdf25020800020008000000080005000300000008000600ba6c0000080006000400000008000100", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r6, @ANYBLOB="08000000d3f946d47bada36daa798579b0afcf2b84782d4be170f1416736f168633d9827c195e70e10b0be8da672302959256a5616edeb2e2757a5096a7826bc939b1a3c822ac6a0aa", @ANYRES32=r7, @ANYBLOB="010071eb00000000110d00"], 0x54}}, 0x20008000)

10:12:22 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:22 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000000)={'ip6gretap0\x00', 0x101000000})
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:22 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:22 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xffffff7f, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:22 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
accept$ax25(r0, &(0x7f0000000000)={{0x3, @bcast}, [@remote, @null, @remote, @bcast, @bcast, @netrom, @default, @null]}, &(0x7f0000000100)=0x48)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:22 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000000)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0xffffffffffffff30)

10:12:22 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5007, 0x0)

10:12:22 executing program 3:
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c)
accept4$ax25(r0, &(0x7f0000000080)={{0x3, @rose}, [@remote, @remote, @bcast, @bcast, @netrom, @bcast, @null, @null]}, &(0x7f0000000100)=0x48, 0x80000)
setsockopt$rose(r0, 0x104, 0x7, &(0x7f0000000040)=0x10000, 0x4)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x2)
connect$rose(r1, &(0x7f0000000000)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, 0x1, @bcast}, 0x1c)

10:12:22 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
close(0xffffffffffffffff)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={<r2=>0x0, r1, 0x0, 0x15, &(0x7f0000000480)='vboxnet1%:ppp1vmnet0\x00', 0xffffffffffffffff}, 0x30)
r3 = syz_open_procfs(r2, &(0x7f0000000440)='oom_adj\x00')
splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x8100000, 0x0)
getresuid(&(0x7f0000000140), &(0x7f0000000180)=<r4=>0x0, &(0x7f00000001c0))
getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@initdev}, 0x0, @in6=@local}}, &(0x7f0000000200)=0xe8)
ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f00000005c0)=ANY=[@ANYBLOB="000000000000000004000000000000000700000013c5ffff0a00000000000000090000000000ff00080000000000000008000000000000000000bc8992e5000000000000000000000000000000000000000000000000000002000000000000000800000000000000090000000000000000000000000000000000000000000000020800000000000000000000000000000000000000000000ff00000000000000810000000000000000000000000000000000000000000000000400000000000000000000000000002139000000000000eb030000000000000200000000000000000000000000000000000000000000000938000000000000000000000000000009000000000000000000000000000000040000000000000000000000000000000000000000000000002000000000000000000000000000000300000000000000010000000000000008000000000000000000000000000000000000000000000002000000000000000000000000000000ff7f0000000000004908000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f00000000000000020000000000000000000000000000000000000000000000030f0000000000000000000000000000ff7f000000000000040000000000000002000000000000000000000000000000000000000000000000040000000000000000000000000000040000000000000005000000000000000100000000000000000000000000000000000000000000000c0800"/592])
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000240)='9p\x00', 0x14091, &(0x7f0000000500)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e22,cachetag=/-,access=', @ANYRESDEC=r4, @ANYBLOB="2c636163687b7461673d6f6f855f61646a002c7461673da2b4eb837188154e156f6f6d5f61646a002c63616368653d6e6f6e672c657569643d", @ANYRES32=r5, @ANYBLOB=',\x00'])

[ 3373.777715][T27944] device nr0
 entered promiscuous mode
[ 3373.806466][T27977] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:22 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000000)=0xffffffff7fffffff, 0x104)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3374.215332][T28260] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:23 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:23 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x500a, 0x0)

10:12:23 executing program 3:
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x4000, 0x0)
getsockopt$IP_VS_SO_GET_SERVICES(r0, 0x0, 0x482, &(0x7f00000001c0)=""/24, &(0x7f0000000200)=0x18)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x4001, 0x0)
open$dir(&(0x7f0000000140)='./file0\x00', 0x103000, 0x4)
accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
open_by_handle_at(r0, &(0x7f0000000280)={0x4b, 0xffffffffffff0160, "fb598cca032bff1b84dc5cf0a0a0383266303020256658841df02c65d36acc8929070b07f78b2388cbb0ec73cac8a727abc14c85ddc7f6d8e30c4a471b9f4e16f5dd0c"}, 0x0)
clock_nanosleep(0x7, 0x1, &(0x7f0000000100)={0x77359400}, &(0x7f0000000240))

10:12:23 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
write$UHID_CREATE2(r0, &(0x7f0000000280)={0xb, 'syz1\x00', 'syz1\x00', 'syz0\x00', 0x39, 0x8, 0x10000, 0x8000, 0x8, 0x3, "c165e2f4fddadc8433ab729f02929a49e72c0128a7b8f834783487d6ea3f6a5a72099420fad84769fe43c1252ddf04c01627fdb808b0daaa99"}, 0x151)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:23 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xffffff9e, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:23 executing program 4:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:23 executing program 0:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vga_arbiter\x00', 0x82080, 0x0)
ioctl$SG_SET_DEBUG(r0, 0x227e, &(0x7f0000000180)=0x1)
pipe(&(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
lsetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="7472040031724a677b4308a700000000"], &(0x7f0000000100)='oom_adj\x00', 0x8, 0x3)
close(r3)
write$cgroup_int(r2, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r1, 0x0, r3, 0x0, 0x8100000, 0x0)

10:12:23 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x502f, 0x0)

10:12:23 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$BLKFRASET(r3, 0x1264, &(0x7f0000000000)=0x11)

[ 3374.556398][T28379] device nr0
 entered promiscuous mode
[ 3374.586366][T28384] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:23 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, r1, 0x0, 0x8, &(0x7f0000000040)='oom_adj\x00', 0xffffffffffffffff}, 0x30)
ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f00000001c0)=<r3=>0x0)
syz_open_procfs(r3, &(0x7f0000000180)='oom_adF\x88\x0f\xf6\xed\n\x1b\xc9j\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:23 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000000440))
write(r0, &(0x7f00000003c0)="d5e35b2c6b18820a3ca4e134ec2e0f8ef2cc427f2471b6cd5e5fdf9f38c00e1f509c24d84c07a8d3a0ed15e27012b34eea572b633724c06a7019d149c150f19c2f4c96183ad4998641b18435089ab3129f08c3574c421a1a1c8b7b06d9c393be6ac643b11b5743c86e0d1e852df7268b7a196d", 0x27dd18d77ceec4a7)
r1 = open(&(0x7f00000006c0)='./file0\x00', 0x101000, 0x53)
mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x6, 0x4030, r1, 0x0)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x9)
ioctl$void(r0, 0xc0045878)
fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, <r2=>0x0})
ptrace$getregset(0x4204, r2, 0x203, &(0x7f0000000140)={&(0x7f0000000280)=""/127, 0x7f})
get_robust_list(r2, &(0x7f00000000c0)=&(0x7f0000000080), &(0x7f0000000100)=0x18)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000240)='./file0\x00', 0x0, 0x12084, 0x0)
r3 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000180)='/dev/btrfs-control\x00', 0x4000, 0x0)
getsockopt$inet_sctp_SCTP_STATUS(r3, 0x84, 0xe, &(0x7f0000000540)={0x0, 0x80, 0x1, 0x7ff, 0x3ff, 0x5, 0x2, 0x8, {<r4=>0x0, @in6={{0xa, 0x4e24, 0x73f, @dev={0xfe, 0x80, [], 0x20}, 0x1000}}, 0x1390, 0x1, 0x5, 0x7fffffff, 0x1}}, &(0x7f0000000600)=0xb0)
getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r3, 0x84, 0x7c, &(0x7f0000000640)={r4, 0x6, 0x30}, &(0x7f0000000680)=0x8)
ioctl$VIDIOC_QUERY_DV_TIMINGS(r3, 0x80845663, &(0x7f0000000300)={0x0, @reserved})
ioctl$BLKROSET(r3, 0x125d, &(0x7f0000000200)=0x10000)

[ 3374.684711][T28413] device nr0
 entered promiscuous mode
[ 3374.712296][T28496] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:23 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xfffffff0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3375.547641][T28501] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:24 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:24 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
getsockopt$llc_int(r0, 0x10c, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:24 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
syz_init_net_socket$llc(0x1a, 0x2, 0x0)
fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)=0x7)

[ 3375.838589][T28602] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:24 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000080)={{0x100000000080}, 'port0\x00'})
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000300))
r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0)
getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000240), &(0x7f0000000280)=0x4)
r2 = socket$inet6(0xa, 0x1, 0x0)
r3 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x40, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x51b7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000440)='/dev/null\x00', 0xa02, 0x0)
sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x9)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r5 = syz_open_procfs(0x0, &(0x7f0000000100)='net/netlink\x00m\x10\x1bDv\xe5j@\xca\x98\"X\xc7k\xb9u\x17w\xed*\xb23\xa9#\xcb\x12\x97\xe9U\x18\xd4\x8d\b\xfc\x845j\x18z\r\xd6\xea\xacE\xd3G\xa9Ki(\xf3\xa3\xfa\xf1\x11(b\am\xd21\x91Q\xbe}\xa3\x8b\r\xc2TR\xa9\tm\x1f\x12hf\xc6\xfa!\x8eK\xd9\x90K\xfa\xc1\x1d\xa9i\x17\a\xdb+\x95Z /\xc9\xafk\xb3!\x05\x17\xcb\x05\tX\x9c~\x85O\x97\x8f\xcc\xcc\xe4\xcb=\xdb\xdf\x1a\x81N\x01>\xdb7\xe3\xe3\xae;3\x8fF\x18\xa4Y `nu\xab!\x9dG\xea\x06\xa7\x83\t\x9b<\x10\xad\a\xb5Ia\xb4f\x97\xb7a4!\xe5h\xabk\x7f\xc4\x9d8\xdb>')
preadv(r5, &(0x7f0000000940)=[{&(0x7f0000000500)=""/112, 0x70}], 0x1, 0x4c000000)
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee68, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$inet_udp_int(0xffffffffffffffff, 0x11, 0xb, 0x0, 0x0)
perf_event_open(&(0x7f0000000a00)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(r4, 0x4c06, r3)
ioctl$FS_IOC_RESVSP(0xffffffffffffffff, 0x40305828, 0x0)
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x2000000000000e)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f00000002c0)=[{&(0x7f0000217f28)=""/231, 0xe7}], 0x1, 0x0)
socket$inet6(0xa, 0x4, 0x7)
recvfrom$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$PPPIOCSDEBUG(r5, 0x40047440, &(0x7f00000005c0)=0xfff)
ioctl$VT_GETSTATE(0xffffffffffffffff, 0x5603, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000080)={@remote, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x1}, 0x20)
ioctl$IOC_PR_PREEMPT(r5, 0x401870cb, &(0x7f00000004c0)={0x103, 0x0, 0x2})

10:12:24 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x3000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:24 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$TCSETS(r0, 0x5402, &(0x7f00000001c0)={0xd7, 0x36, 0x1, 0x1ff, 0x2, 0x80, 0xffff, 0x7ff, 0x7f, 0xa6, 0x89e})
close(r1)
getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000280)={'nat\x00'}, &(0x7f0000000180)=0x78)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
ioctl$IMGETDEVINFO(r1, 0x80044944, &(0x7f0000000000)={0x8000})
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
getsockopt$bt_l2cap_L2CAP_CONNINFO(r3, 0x6, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x6)

10:12:24 executing program 3:
r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x0, 0x0)
getpeername$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @local}, &(0x7f0000000280)=0x28c)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getsockopt$sock_buf(r1, 0x1, 0x3f, &(0x7f00000002c0)=""/4, &(0x7f0000000300)=0x4)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/bnep\x00')
getsockname$ax25(r2, &(0x7f00000000c0)={{0x3, @null}, [@default, @bcast, @netrom, @netrom, @rose, @null, @rose, @null]}, &(0x7f0000000040)=0x48)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
write$P9_RCLUNK(r2, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)

10:12:25 executing program 0:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffefff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:25 executing program 4:

10:12:25 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
ustat(0x1dd9, &(0x7f0000000000))
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

[ 3376.717240][T28610] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3376.739656][T28931] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3376.886296][T28777] device nr0
 entered promiscuous mode
[ 3378.404034][T28933] IPVS: ftp: loaded support on port[0] = 21
[ 3378.650564][T23713] IPVS: stopping master sync thread 3674 ...
[ 3378.693669][T23713] device bridge_slave_1 left promiscuous mode
[ 3378.707663][T23713] bridge0: port 2(bridge_slave_1) entered disabled state
[ 3378.769742][T23713] device bridge_slave_0 left promiscuous mode
[ 3378.776025][T23713] bridge0: port 1(bridge_slave_0) entered disabled state
[ 3382.942135][T23713] device hsr_slave_1 left promiscuous mode
[ 3382.984831][T23713] device hsr_slave_0 left promiscuous mode
[ 3383.054260][T23713] team0 (unregistering): Port device team_slave_1 removed
[ 3383.087598][T23713] team0 (unregistering): Port device team_slave_0 removed
[ 3383.113228][T23713] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 3383.177544][T23713] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 3383.348586][T23713] bond0 (unregistering): Released all slaves
[ 3383.506193][T28933] chnl_net:caif_netlink_parms(): no params data found
[ 3383.595215][T28933] bridge0: port 1(bridge_slave_0) entered blocking state
[ 3383.608463][T28933] bridge0: port 1(bridge_slave_0) entered disabled state
[ 3383.618475][T28933] device bridge_slave_0 entered promiscuous mode
[ 3383.676649][T28933] bridge0: port 2(bridge_slave_1) entered blocking state
[ 3383.690478][T28933] bridge0: port 2(bridge_slave_1) entered disabled state
[ 3383.703337][T28933] device bridge_slave_1 entered promiscuous mode
[ 3383.764983][T28933] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 3383.791121][T28933] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 3383.841600][T28933] team0: Port device team_slave_0 added
[ 3383.849623][T28933] team0: Port device team_slave_1 added
[ 3383.918002][T28933] device hsr_slave_0 entered promiscuous mode
[ 3383.979092][T28933] device hsr_slave_1 entered promiscuous mode
[ 3384.040330][T28933] bridge0: port 2(bridge_slave_1) entered blocking state
[ 3384.047449][T28933] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 3384.054882][T28933] bridge0: port 1(bridge_slave_0) entered blocking state
[ 3384.062001][T28933] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 3384.165310][T28933] 8021q: adding VLAN 0 to HW filter on device bond0
[ 3384.187699][T14095] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 3384.202837][T14095] bridge0: port 1(bridge_slave_0) entered disabled state
[ 3384.214093][T14095] bridge0: port 2(bridge_slave_1) entered disabled state
[ 3384.243678][T14095] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 3384.274068][T28933] 8021q: adding VLAN 0 to HW filter on device team0
[ 3384.292079][T14095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 3384.312068][T14095] bridge0: port 1(bridge_slave_0) entered blocking state
[ 3384.319260][T14095] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 3384.370245][T14095] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 3384.389237][T14095] bridge0: port 2(bridge_slave_1) entered blocking state
[ 3384.396450][T14095] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 3384.420006][T14095] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 3384.462911][T19264] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 3384.471973][T19264] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 3384.491710][T19264] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 3384.509458][T19264] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 3384.520682][T28933] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 3384.568862][T28933] 8021q: adding VLAN 0 to HW filter on device batadv0
10:12:33 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f00000001c0)="c0dca5055e0bcfec7be070")
r2 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3, 0x11, r3, 0x0)
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r2, 0x2405, r3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000004, 0x8031, 0xffffffffffffffff, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
getgroups(0x2, &(0x7f0000000040)=[<r5=>0x0, 0xee00])
lstat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0})
r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000400)='memory.stat\x00', 0x0, 0x0)
ioctl$TIOCVHANGUP(r7, 0x5437, 0x0)
stat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0})
lstat(&(0x7f0000000300)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0})
setgroups(0x5, &(0x7f00000003c0)=[r4, r5, r6, r8, r9])

10:12:33 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x0, 0x800)
setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f00000000c0)={{0x6, 0x400}, 0x8}, 0x10)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:33 executing program 4:

10:12:33 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
pread64(r2, &(0x7f0000000100)=""/173, 0xad, 0x0)
close(r2)
syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x8, 0x1)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:33 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x40030000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:33 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3384.814113][T28949] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:33 executing program 4:

[ 3384.865485][T28954] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:33 executing program 0:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
set_robust_list(&(0x7f00000002c0)={&(0x7f0000000200), 0x8000, &(0x7f0000000280)}, 0x18)
write$cgroup_int(r1, &(0x7f0000000080)=0xffffffff80000001, 0x12)
r3 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
sigaltstack(&(0x7f0000fff000/0x1000)=nil, &(0x7f00000001c0))
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)
ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f0000000180)={0x0, 0x1e, 0x8b})
ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r1, 0x40045730, &(0x7f0000000140)=0x5)
lsetxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.SMACK64\x00', &(0x7f0000000100)='\xf9&\x00', 0x3, 0x3)

10:12:33 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf0ffffffffffff, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:33 executing program 4:

10:12:33 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x80, 0x38001)
ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x20d)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:33 executing program 0:

[ 3385.064730][T28952] device nr0
 entered promiscuous mode
[ 3385.102828][T28961] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:34 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000000c0)=@v1={0x1000000, [{0x7, 0x7fffffff}]}, 0xc, 0x8d0069444dd83660)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:34 executing program 4:

10:12:34 executing program 0:
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = eventfd2(0x0, 0x0)
r1 = dup(r0)
r2 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x7fff)
sendfile(r1, r2, 0x0, 0x8000fffffffe)

10:12:34 executing program 2:
r0 = memfd_create(&(0x7f0000000100)='selinux/user\x00', 0x5)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000000))
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:34 executing program 4:
sendmsg$alg(0xffffffffffffffff, 0x0, 0x0)
r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0)
fallocate(r0, 0x20, 0x0, 0xfffffeff000)
perf_event_open(0x0, 0x0, 0x6, 0xffffffffffffffff, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0)
inotify_init()
r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x14)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
fallocate(r2, 0x0, 0x0, 0x10000101)
perf_event_open(&(0x7f00000002c0)={0x0, 0x70, 0x35, 0xd4, 0x4, 0x2, 0x0, 0xfcf, 0x0, 0x0, 0xa0bd, 0x7, 0x3, 0x0, 0x401, 0x0, 0x0, 0x0, 0x380000000000000, 0x5, 0x3f, 0x9, 0x0, 0x0, 0x0, 0x80, 0x0, 0x34d, 0x8f, 0x1, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x4, 0x0, 0x7, 0x3ff, 0x3, 0x10001}, 0x0, 0x7, r1, 0xb)

[ 3385.776230][T28967] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:34 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:34 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x4400, 0x0)
ioctl$VT_GETMODE(r1, 0x5601, &(0x7f00000000c0))
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:34 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x100000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:34 executing program 0:
sendmsg$alg(0xffffffffffffffff, 0x0, 0x0)
r0 = memfd_create(0x0, 0x0)
pwritev(r0, 0x0, 0x0, 0x881806)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0)
fallocate(r1, 0x20, 0x0, 0xfffffeff000)
r2 = open(0x0, 0x0, 0x0)
perf_event_open(0x0, 0x0, 0x6, 0xffffffffffffffff, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000180), 0x4)
inotify_init()
r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getpeername$packet(r2, &(0x7f0000000240), &(0x7f0000000280)=0x14)
socket$unix(0x1, 0x1, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, 0x0)
getsockopt$inet_int(0xffffffffffffffff, 0x0, 0x1d, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
fallocate(r4, 0x0, 0x0, 0x10000101)
perf_event_open(&(0x7f00000002c0)={0x7, 0x70, 0x35, 0xd4, 0x4, 0x2, 0x0, 0xfcf, 0x8800, 0xf, 0xa0bd, 0x7, 0x3, 0x9, 0x401, 0x401, 0x0, 0x1f, 0x380000000000000, 0x5, 0x3f, 0x9, 0x8000, 0x1ff, 0x9, 0x80, 0x0, 0x34d, 0x8f, 0x1, 0x4, 0x3, 0x10001, 0x7fff, 0x8, 0x8, 0xdca0, 0x73e8, 0x0, 0x8, 0x0, @perf_bp={0x0, 0x7}, 0x0, 0x4, 0x3ff, 0x7, 0x3ff, 0x3, 0x10001}, 0x0, 0x7, r3, 0xb)

[ 3386.017054][T29247] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:34 executing program 3:
r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000)
ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000000)="979b9669e092f64252b5b55d127dc4df6e6f6b772592d338d771c252d06e6cb28f69db3da5b4e991")
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
accept$nfc_llcp(r0, &(0x7f00000000c0), &(0x7f0000000140)=0x60)
ioctl$SIOCRSGL2CALL(r1, 0x89e5, &(0x7f0000000040)=@bcast)

10:12:35 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000000100)="b06d4a7a51cf5995447309961a472b764dbb600dd7a07d68cbcd57c56e57942878cc6e075bbe34e0f8cc9cdb17e0d7a07d2d7a7d560a8e9cef1f5c5647be5859a039ecc7ffd743e6f84744592e04d919bfcc01e4457b4db7c9a010d02a7e9e2b2a189ef92d5939d3b41de6f87f5b552fcda756aa0c2e392f2470b7d86098ecbebb1c13fc017a7026ec7beee655cbc1f966d9ec65378b76", 0x97)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ubi_ctrl\x00', 0x0, 0x0)
ioctl$TCFLSH(r1, 0x540b, 0xffffffffffffbbc3)
ioctl$GIO_CMAP(r1, 0x4b70, &(0x7f0000000240))
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
fstatfs(r0, &(0x7f0000000080)=""/60)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000280)='/dev/ashmem\x00', 0x200002, 0x0)
mount(&(0x7f0000000000)=ANY=[@ANYRES16=r0, @ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRES64=r0], &(0x7f00000000c0)='./file0\x00', 0x0, 0x5010, 0x0)

[ 3386.246240][T29229] device nr0
 entered promiscuous mode
10:12:35 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x200000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3386.311458][T29307] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:35 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
socket$pptp(0x18, 0x1, 0x2)

10:12:35 executing program 4:
r0 = socket$inet(0x10, 0x2000000003, 0x0)
sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000140)="240000002e0007031dfffd946fa2830020200a0009000000001985680c1ba3a20400ff7e280000005e00ffffba162441caf0da3b40c925234476d0b80ca0aa1c0009b3ebea8653b1cc7e6397", 0x4c}], 0x1}, 0x0)

10:12:35 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = socket$bt_rfcomm(0x1f, 0x1, 0x3)
write(r1, &(0x7f0000002000)='\x00', 0x1)
sendfile(r0, r0, &(0x7f0000000140), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x8001, 0x1)
accept4(r2, &(0x7f0000000200)=@ipx, &(0x7f0000000040)=0x80, 0x80000)
write$P9_RATTACH(r2, &(0x7f0000000100)={0x14, 0x69, 0x1, {0x50, 0x4, 0x8}}, 0x14)
write$P9_RATTACH(r2, &(0x7f00000000c0)={0x14, 0x69, 0x2, {0x60, 0x1, 0x5}}, 0x14)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3386.492440][   T27] audit: type=1800 audit(1559643155.289:9429): pid=29394 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="bus" dev="sda1" ino=16813 res=0
10:12:35 executing program 0:
r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xee67, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000540)='/dev/usbmon#\x00', 0x7f, 0x2000)
ioctl$PPPIOCSDEBUG(r1, 0x40047440, &(0x7f0000000600)=0x80000001)
ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000580))
r2 = fcntl$dupfd(r0, 0x40a, r1)
getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000100)={'ipvs\x00'}, &(0x7f0000000500)=0x10a)
splice(r1, &(0x7f0000000000), r0, &(0x7f0000000140), 0x8, 0xc)
r3 = creat(&(0x7f00000000c0)='./bus\x00', 0x0)
pwritev(r0, &(0x7f0000001ac0)=[{&(0x7f0000000ac0)}], 0x1, 0x0)
r4 = socket$inet6(0xa, 0x400000000001, 0x0)
ioctl$sock_TIOCINQ(r4, 0x541b, &(0x7f00000002c0))
r5 = dup(r4)
ioctl$FICLONE(r5, 0x40049409, r4)
setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x7, 0x0, 0x0)
prctl$PR_MCE_KILL_GET(0x22)
setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f00000003c0)=0x7f, 0x4)
ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r1, 0xc0bc5310, &(0x7f0000000300))
ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000400)={0x3, &(0x7f0000000280)=[{0x3, 0x0, 0x1a1a, 0x4}, {0x100000001, 0x0, 0x1cb, 0x4}, {0x80000001, 0x3, 0x1, 0x7}]})
bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendto$inet6(r4, 0x0, 0x0, 0x2000000c, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c)
setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000180)='syz_tun\x00', 0x10)
r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r7 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0)
splice(r7, &(0x7f0000000200), r6, &(0x7f0000000240), 0x7, 0x3)
ftruncate(r7, 0x2007ffc)
sendfile(r5, r7, 0x0, 0x8000fffffffe)
ioctl$sock_inet_SIOCGIFPFLAGS(r3, 0x8935, &(0x7f00000001c0)={'ip_vti0\x00', 0x200})

10:12:35 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000))
lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000280)=ANY=[@ANYBLOB="00fb7c070677125cb45aa737a6839911ade31c9d6ac6a42213da0b3b6a8c25be77830ea6afec76ecb5312af518973c145241c0481dc4dc3c50116c671cfa95d90f8befb2c067a2811262c44ac80ed60856c36115668c24cd24e86dc3afdf65caabe3043724d58e128d7f1eb531e5bcd40007ca0ed804a1758368c36d0e34c295beeb51924500ba7b9b639170bee20b1451775c1428d73dd9c7f845bc7cb3d76240853b31d74991a2d0cb63fe598b55f88d9536a2700f02bdc9471f6cc3a23a357a7509c55965dd8811e1dadeb5e48328edab2a5ac71864d4a75699d4134ea022086608961b0c1ccd95d4fdc92ccbf639c8e74de082b085f86374de612909c2310901866ae9ade2c439a4eeafaee2b00eff559a93ff4f738a96579ba0"], 0x7c, 0x3)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0)=0x800000000, 0xfec)
mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8000000002, 0xc0110, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000140)='/dev/audio#\x00', 0x0, 0x1)
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/nat_icmp_send\x00', 0x2, 0x0)
r3 = accept4$inet(0xffffffffffffffff, 0x0, &(0x7f0000000200), 0x80800)
ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000000440)={r2, r3, 0x100000000, 0x78, &(0x7f00000003c0)="cf58257f8659c4bfbc66ea75d03237ba92b150904227ce458d00a182e5d275ba19dc5c022d0658bb4ed31d1bf2687e88f5ae44fb9b2463bc4a2f363a67a59d36fdec64141f7b21bb2a0fc3e2efb71298955ae7b18b8b307d7f2b20190a2b435d409d6f1ff556462f097a0cd3b6dcc493d6d863e8349db6db", 0x5, 0x3f, 0x401, 0xd18, 0x3, 0x2, 0x4, 'syz0\x00'})
socket$pppoe(0x18, 0x1, 0x0)

[ 3386.963241][T29593] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:35 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x40042, 0x0)
ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f00000000c0)={0x1, 0x0, {0x8, 0x1ff, 0x2010, 0xf, 0x8, 0x4, 0x0, 0x4}})

10:12:35 executing program 2:
r0 = memfd_create(&(0x7f0000000340)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000000000)="c9", 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000300), 0x20500)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000000c0)={{{@in6=@local, @in6=@loopback}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in6=@empty}}, &(0x7f0000000200)=0xe8)
openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x4040, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ubi_ctrl\x00', 0x4402, 0x0)
connect$can_bcm(r1, &(0x7f0000000240), 0x10)

[ 3387.010801][T29717] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:35 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:35 executing program 4:
r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x80000802, 0x0)
write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00'}, 0x45c)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2)
ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8)
openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000180))
creat(0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000000)='cgroup\x00', 0x0, 0x0)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0)
getpgid(0x0)
ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1)
ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0)
syz_open_dev$mice(0x0, 0x0, 0x0)

10:12:35 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x300000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3387.171370][T29722] input: syz1 as /devices/virtual/input/input10
10:12:36 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = semget(0x1, 0x3, 0x0)
semctl$SEM_INFO(r1, 0x0, 0x13, &(0x7f0000000000)=""/113)
r2 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000100)={0x2, 0x0, @initdev}, &(0x7f0000000140)=0x10, 0x0)
setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e20, 0xfffffffffffffff9, @dev={0xfe, 0x80, [], 0x17}, 0x8000}}, 0xffffffff, 0xbc4, 0x3, 0xfff, 0x80}, 0x98)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0))

[ 3387.238175][T29900] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3387.277864][T29972] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:36 executing program 0:
pipe(&(0x7f0000000500)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
shutdown(0xffffffffffffffff, 0x0)
write$P9_RFLUSH(r1, &(0x7f0000000040), 0xffffff7e)
write$P9_RSTAT(r1, &(0x7f0000000080)={0x55, 0x7d, 0x0, {0x0, 0x4e, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x1, '}', 0x0, '', 0x8, 'selinux/', 0x12, 'selinux/,vboxnet1['}}, 0x55)
dup2(r1, r0)

10:12:36 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x400000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:36 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80000, 0x0)
sendmsg$nl_crypto(r1, &(0x7f0000000140)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x28000060}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=@getstat={0xe0, 0x15, 0x128, 0x70bd26, 0x25dfdbfb, {{'drbg_pr_sha256\x00'}, [], [], 0x2400, 0x2000}, ["", ""]}, 0xe0}, 0x1, 0x0, 0x0, 0x800}, 0x44004)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:36 executing program 4:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
mmap$perf(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, 0x0)
ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, 0x0)
write$P9_RFLUSH(r1, &(0x7f0000000040), 0xffffff7e)
write(r1, &(0x7f0000000200)="99", 0x1)
dup2(r1, r0)

[ 3387.471945][T29974] device nr0
 entered promiscuous mode
10:12:36 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x3, 0x10400)
ioctl$SIOCX25SCUDMATCHLEN(r1, 0x89e7, &(0x7f0000000040)={0x45})

10:12:36 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:36 executing program 0:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
shutdown(0xffffffffffffffff, 0x0)
write$P9_RFLUSH(r1, &(0x7f0000000040), 0xffffff7e)
write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0)
getsockname(0xffffffffffffffff, 0x0, 0x0)
write$P9_RWRITE(r1, &(0x7f00000000c0)={0xb}, 0xb)
dup2(r1, r0)

10:12:36 executing program 4:
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
mmap$perf(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_GETFSLABEL(0xffffffffffffffff, 0x81009431, 0x0)
ioctl$KDGKBTYPE(0xffffffffffffffff, 0x4b33, 0x0)
write$P9_RFLUSH(r1, &(0x7f0000000040), 0xffffff7e)
write$binfmt_misc(r1, &(0x7f0000000240)={'syz0'}, 0x4)
dup2(r1, r0)

10:12:37 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:37 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x80800)
ioctl$DRM_IOCTL_SET_VERSION(r1, 0xc0106407, &(0x7f00000000c0)={0x7, 0x100, 0x7, 0x7})
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:37 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
accept4(r0, &(0x7f0000000140)=@can={0x1d, <r2=>0x0}, &(0x7f00000001c0)=0x80, 0x80800)
setsockopt$inet6_mreq(r1, 0x29, 0x1c, &(0x7f0000000200)={@loopback, r2}, 0x14)
getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:37 executing program 0:
perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000940)='numa_maps\x00')
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0)
sendfile(r0, r0, &(0x7f0000000000)=0xf00, 0xffff)

10:12:37 executing program 4:
bpf$BPF_MAP_GET_NEXT_ID(0xc, 0x0, 0x0)
perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000940)='numa_maps\x00')
mmap$IORING_OFF_CQ_RING(&(0x7f0000bbd000/0x14000)=nil, 0x14000, 0x0, 0x100000010, 0xffffffffffffffff, 0x8000000)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0)
sendfile(r0, r0, &(0x7f0000000000)=0xf00, 0xffff)

10:12:37 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x500000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:37 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="11dca5055e0bcfec7be070")
r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x1e, &(0x7f0000000280)=ANY=[@ANYBLOB="b7000000000000004d000000000000009500000000000000677d4e6350029cec81e47ce1ec1bedca2e7ce21aee518397006ffc9e10f6dec85b70354a42da80e7c0f52c51aad7c460a129ab2a2908f8f685f2782f8945119b79826be32d0fc5581ad22ae6fed11eb5b24a06fbb51b6f37c31a93e47273a97da3b954ce38ce313a017aaaaf34c90e9b2bdb66ccc3899d8ebc74bc515d90dca3e2d64bf8d4b686d86492fa7237d61f5f9e9cad21b34afd34bba91222c49ac95643fff618ee3793544fd35fe44402da6d9981a9bda715ace4ba42f719bff145f8cd88dd6b1bd2347828cc7b437ac7247baec8f25bb9cde15cc8"], 0x0, 0x1, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x70)
setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r1, 0x4)

10:12:37 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x600000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:37 executing program 4:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f0000000300), 0x4)
r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/tcp6\x00')
ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = socket$inet6(0xa, 0x400000000001, 0x0)
prctl$PR_GET_TID_ADDRESS(0x28, 0x0)
setsockopt$IP_VS_SO_SET_EDITDEST(r1, 0x0, 0x489, &(0x7f0000000280)={{0x67, @multicast1, 0x0, 0x2, 'lc\x00', 0x20, 0x8, 0x13}, {@multicast1}}, 0x44)
umount2(0x0, 0x0)
prctl$PR_SET_TIMERSLACK(0x1d, 0x0)
bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r3, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070")
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup\x00', 0x200002, 0x0)
fchdir(r4)
creat(&(0x7f0000000100)='./file0\x00', 0x0)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
dup2(0xffffffffffffffff, 0xffffffffffffffff)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0)
getsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0)
ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a1, 0x0)
setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0)
sendto$inet6(r2, 0x0, 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r5 = open(&(0x7f0000000100)='./bus\x00', 0x141042, 0x1)
setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000001c0)=0x4, 0x4)
sendfile(r2, r5, &(0x7f00000000c0), 0x8000fffffffe)

10:12:37 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x40, 0x0)
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00')
setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000340)=0x101, 0x4)
sendmsg$TIPC_CMD_GET_BEARER_NAMES(r1, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x310, 0x70bd2d, 0x25dfdbff, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000004}, 0x40)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r2, 0x0, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000)
ioctl$TIOCSIG(r1, 0x40045436, 0x28)

10:12:37 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$SIOCRSACCEPT(r2, 0x89e3)
ioctl$TIOCSPTLCK(r1, 0x40045431, &(0x7f0000000040)=0x1)

[ 3388.531464][T30670] device nr0
 entered promiscuous mode
10:12:37 executing program 0:
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='coredump_filter\x00')
write$binfmt_misc(r0, &(0x7f00000003c0)=ANY=[@ANYRESOCT, @ANYRESDEC], 0x2b)

10:12:37 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:37 executing program 4:
syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/netstat\x00')

10:12:37 executing program 0:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x1c)

10:12:37 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/ubi_ctrl\x00', 0x400, 0x0)
ioctl$UI_SET_FFBIT(r1, 0x4004556b, 0x6e)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f00000002c0)=0xe8)
mount$9p_tcp(&(0x7f0000000100)='127.0.0.1\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x1, &(0x7f0000000300)={'trans=tcp,', {'port', 0x3d, 0x4e20}, 0x2c, {[], [{@audit='audit'}, {@fscontext={'fscontext', 0x3d, 'user_u'}}, {@permit_directio='permit_directio'}, {@fowner_gt={'fowner>', r2}}, {@obj_type={'obj_type', 0x3d, '/dev/adsp#\x00'}}, {@fsmagic={'fsmagic', 0x3d, 0x80}}, {@appraise_type='appraise_type=imasig'}]}})
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r3 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0xac92, 0x10400)
ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000040)={&(0x7f0000ffb000/0x4000)=nil, 0x4000})
fspick(r3, &(0x7f00000000c0)='./file0\x00', 0x1)

10:12:37 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x700000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:37 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0)=0x2, 0x5)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:37 executing program 0:
pipe(&(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
r2 = socket$inet_udp(0x2, 0x2, 0x0)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r3, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070")
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x4c7)
syz_open_procfs(0x0, &(0x7f0000000240)='coredump_filter\x00')
write$binfmt_misc(r1, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0xff49)
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:37 executing program 4:
creat(0x0, 0x0)
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(aes-aesni)\x00'}, 0x58)
r1 = accept4(r0, 0x0, 0x0, 0x0)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18)
recvfrom(r1, &(0x7f0000000140)=""/163, 0x100000345, 0x0, 0x0, 0x0)
sendto$unix(r1, &(0x7f0000000140), 0x14ded905162a6a4b, 0x0, 0x0, 0x429)
recvfrom(r1, &(0x7f0000003240)=""/4096, 0x100000205, 0x0, 0x0, 0x415)
sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB], 0x1}}, 0x0)

10:12:38 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f00000000c0)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}}, 0xff30)

10:12:38 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:38 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000140)=ANY=[@ANYRES64=0x0, @ANYPTR64=&(0x7f0000000000)=ANY=[@ANYBLOB="c78b036b5103e3082871e22af98b8b6caf6fbba5253e2021c657292d7127cc29cdac4930c3b1ec", @ANYRES32=r0], @ANYPTR64, @ANYRES32=r0, @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0, @ANYRES64=r0, @ANYRESOCT=r0, @ANYRESOCT=r0], @ANYRESDEC=r0, @ANYRESHEX=r0], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:38 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x200800, 0x0)
r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000140)='/proc/capi/capi20\x00', 0x80, 0x0)
signalfd4(r2, &(0x7f00000001c0)={0x1f}, 0x8, 0x800)
renameat2(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00', 0x5)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="04bb71fae51c7720d64b8f4902afffb407985b3d744312e4b3b2903d420ecaf6e253d0fdf10c02c80e6ac4459004beb5df0711c130a66b6aa67f6d5b8b3d728cea7e60e7e2e43e4573c41cfe3ce3c11aa8", 0x51)
r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200, 0x0)
setsockopt$inet_tcp_TCP_QUEUE_SEQ(r3, 0x6, 0x15, &(0x7f0000000040)=0x400, 0x4)

[ 3389.431064][T31148] device nr0
 entered promiscuous mode
10:12:38 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:38 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000001640)={'ip_vti0\x00', {0x2, 0x0, @dev}})

10:12:38 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xa3a000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:38 executing program 0:
connect$unix(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="820201f0ffffffff"], 0x1)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r0 = socket(0x2, 0x5, 0x0)
connect$unix(r0, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x10)

10:12:38 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x80000)
ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x0)

10:12:38 executing program 3:
r0 = fcntl$getown(0xffffffffffffffff, 0x9)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={<r1=>0x0}, &(0x7f0000000040)=0xc)
socketpair$tipc(0x1e, 0x7, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x3, 0x301100)
kcmp(r0, r1, 0x2, r2, r3)
r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r4, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3389.898572][T31525] validate_nla: 10 callbacks suppressed
[ 3389.898582][T31525] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:38 executing program 4:
connect$unix(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="820201f0ffff"], 0x1)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r0 = socket(0x2, 0x5, 0x0)
connect$unix(r0, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x10)

10:12:38 executing program 0:
connect$unix(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="9f020101000080"], 0x1)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
r0 = socket(0x2, 0x5, 0x0)
connect$unix(r0, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x10)

[ 3389.968282][T31597] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:38 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = accept4$ax25(0xffffffffffffff9c, 0x0, &(0x7f00000000c0), 0x80000)
ioctl$SIOCAX25ADDFWD(r1, 0x89ea, &(0x7f0000000100)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null})
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)

10:12:38 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000000)={'paT0\x00', {0x2, 0x4e24, @rand_addr=0xfffffffffffffb28}})

10:12:38 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xe00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:38 executing program 0:
r0 = socket(0x11, 0x800000003, 0x600081)
bind(r0, &(0x7f0000000000)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
setsockopt$inet_MCAST_LEAVE_GROUP(0xffffffffffffffff, 0x0, 0x2d, 0x0, 0x362)
r1 = dup(r0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0)
ftruncate(r2, 0x2007fff)
sendfile(r1, r2, 0x0, 0x8000fffffffb)

[ 3390.178368][T31566] device nr0
 entered promiscuous mode
[ 3390.206040][T31749] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3390.228005][T31821] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:39 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:39 executing program 4:
r0 = syz_open_dev$sndseq(&(0x7f0000000600)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a85320, &(0x7f0000000180)={{0x84}, 'port0\x00', 0xfffffffffffffffe, 0x0, 0xfa8d, 0x0, 0x2, 0x2000000000000000, 0x0, 0x0, 0x2, 0x1000})
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = add_key$keyring(&(0x7f0000000580)='keyring\x00', &(0x7f0000000640)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff9)
r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000001380)=[{&(0x7f0000000240)='E', 0x1}], 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc547, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x8, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
keyctl$clear(0x7, r2)
prctl$PR_GET_FP_MODE(0x2e)
r4 = socket$inet6_udp(0xa, 0x2, 0x0)
r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r4, 0x89a1, &(0x7f0000000400)={@local={0xfe, 0x80, [0x600, 0x3ef, 0x0, 0x3f00000000000000, 0x100000000000000, 0x0, 0x1103, 0x0, 0x0, 0x0, 0x0, 0x6]}})
ioctl$sock_inet6_SIOCADDRT(r4, 0x89a0, &(0x7f0000000100)={@local={0xfe, 0x80, [0x0, 0xfeff0000]}, @empty, @loopback})
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, 0x0)
getpeername$packet(0xffffffffffffff9c, 0x0, 0x0)
getpeername$packet(0xffffffffffffff9c, 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0106434, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x5})
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0)
write$P9_RCLUNK(0xffffffffffffffff, &(0x7f0000000500)={0x7, 0x79, 0x1}, 0x7)
r6 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
write$P9_RMKNOD(0xffffffffffffffff, &(0x7f0000001e00)={0xfffffffffffffdf2, 0x13, 0x100002, {0x3e, 0x0, 0x8}}, 0xffffffffffffffbf)
sendfile(r5, r1, &(0x7f00000005c0), 0x8001)
getsockopt$EBT_SO_GET_ENTRIES(r6, 0x0, 0x81, &(0x7f0000000280)={'nat\x00', 0x0, 0x3, 0xe, [], 0x5, &(0x7f0000000480)=[{}, {}, {}, {}, {}], &(0x7f0000000040)=""/14}, &(0x7f00000003c0)=0x78)

10:12:39 executing program 3:
r0 = syz_open_dev$media(&(0x7f0000000040)='/dev/media#\x00', 0x1, 0x2002)
r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000001180)='nbd\x00')
sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xc0000}, 0xc, &(0x7f0000001240)={&(0x7f0000001300)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="10032dbd7000fcdbdf25010000000c0002000000ffffffffffff0c00050022010000000000000c00040009000000000000000c00060003000000000000000c00050024010000000000000c00020004000000000000004bc922bbcfd6954f9faff3eeed7ee15eda103d9109c2a7b4ac9bf3ea0a349b198e5c05ec1147c138404ebc5fec3903145243c1c0819064a21856f7549cde58f13284520f0a5c7b9daaaec254da6971aae3331f3c4093846d23c2e75cd64812003252787d7c9c16a6ceb1b83f7181d5acfe780664583b9a00224da5bf1888d64eb33c5ba28c636669529f42a6f95ac6a3fb6260cb9b3d7dfcebdac47b96f2007509a367dd8a2e8f307bf725b08ee94c90bbf1955e064a766b632d3478436c89d1b797377c7bef0a"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x10)
syz_init_net_socket$rose(0xb, 0x5, 0x0)
r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x2, 0x8c180)
ioctl$EVIOCGABS2F(r2, 0x8018456f, &(0x7f0000000140)=""/4096)
ioctl$SNDRV_TIMER_IOCTL_PAUSE(r2, 0x54a3)
connect$rose(r0, &(0x7f00000011c0)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x3b)
recvmsg(r0, &(0x7f0000003580)={&(0x7f0000001440)=@un=@abs, 0x80, &(0x7f0000001200)=[{&(0x7f00000014c0)=""/4096, 0x1000}, {&(0x7f0000001140)=""/27, 0x1b}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f00000034c0)=""/186, 0xba}], 0x4, &(0x7f00000012c0)=""/60, 0x3c}, 0x40)
sysfs$2(0x2, 0x6, &(0x7f00000000c0)=""/128)

10:12:39 executing program 2:
r0 = syz_open_dev$midi(&(0x7f0000000180)='/dev/midi#\x00', 0x0, 0x400)
ioctl$PPPIOCGMRU(r0, 0x80047453, &(0x7f0000000200))
r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r1, &(0x7f0000002000)='/', 0x1)
sigaltstack(&(0x7f0000000000/0x2000)=nil, &(0x7f0000000240))
ioctl$SIOCX25GCAUSEDIAG(r0, 0x89e6, &(0x7f0000000340)={0xfffffffffffffffb, 0x400})
sendfile(r1, r1, &(0x7f0000000040), 0x7f)
setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f0000000280)=0xffffffffffffffff, 0x4)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
fcntl$dupfd(r1, 0x406, r0)
ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000300)={0x3, 0x6})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0)
r2 = dup(r0)
openat$vcs(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vcs\x00', 0x80000, 0x0)
finit_module(r1, &(0x7f0000000140)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x1)
syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8c8, 0x84000)
ioctl$sock_ax25_SIOCDELRT(r2, 0x890c, &(0x7f00000000c0)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x2, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @default, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]})
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:39 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3390.695520][T31856] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3390.733129][T31861] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:39 executing program 3:
r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2)
write$tun(r0, &(0x7f0000000040)={@val, @void, @eth={@random="a4b264d2aabf", @empty, [{[{0x9100, 0x35, 0xffffffff}], {0x8100, 0x9, 0x9, 0x4}}], {@can={0xc, {{0x4, 0x7, 0x4, 0x100000000}, 0x2, 0x2, 0x0, 0x0, "f59520ef89b3369d"}}}}}, 0x2a)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:39 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x2000000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:39 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4)
ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x1)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:39 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
getresuid(&(0x7f0000000140)=<r2=>0x0, &(0x7f0000000180), &(0x7f00000001c0))
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, <r3=>0x0}, &(0x7f0000000240)=0xc)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f0000000380)=0xe8)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000003c0)={0x0, <r5=>0x0}, &(0x7f0000000400)=0xc)
semget$private(0x0, 0x0, 0x2)
r6 = getuid()
getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000440)={{{@in=@broadcast, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{}, 0x0, @in6=@mcast1}}, &(0x7f0000000540)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000580)={{{@in, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@broadcast}}, &(0x7f0000000680)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000006c0)={{{@in=@initdev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in=@broadcast}, 0x0, @in6=@initdev}}, &(0x7f00000007c0)=0xe8)
getresgid(&(0x7f0000000800), &(0x7f0000000840)=<r10=>0x0, &(0x7f0000000880))
fsetxattr$system_posix_acl(r0, &(0x7f0000000040)='system.posix_acl_default\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="02000000010002000000000002000000", @ANYRES32=r1, @ANYBLOB="02000400", @ANYRES32=r2, @ANYBLOB="02000100", @ANYRES32=r3, @ANYBLOB="02000100", @ANYRES32=r4, @ANYBLOB="02000100eaed38c97fd3a060b7527605cf6a92", @ANYRES32=r5, @ANYBLOB="02000700", @ANYRES32=r6, @ANYBLOB="02000200", @ANYRES32=r7, @ANYBLOB="02000200", @ANYRES32=r8, @ANYBLOB="02000300", @ANYRES32=r9, @ANYBLOB="040004000000000008000100", @ANYRES32=r10, @ANYBLOB="10000700000000002000010000000000"], 0x74, 0x1)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, "286b49d84ed689e9", "5de8bd6888fb0e652697065fc5e651677e6ac0910008ae71b36ac15a115a73e9", ' +Vb', "646a9cc328c9391a"}, 0x38)

10:12:40 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000000c0)=0x5)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:40 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7be070")
futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x85, 0x0, 0x0, 0x0, 0x5000000)

[ 3391.264537][T31869] device nr0
 entered promiscuous mode
[ 3391.284697][T32060] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:40 executing program 3:
r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x4000, 0x0)
ioctl$KDSETMODE(r0, 0x4b3a, 0x743)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0)
bind$rxrpc(r2, &(0x7f0000000040)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e20, 0x51, @local, 0x4}}, 0x24)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f00000001c0)={0x3, 0xf4, 0xd5d7})
write$binfmt_misc(r2, &(0x7f00000002c0)=ANY=[@ANYBLOB="73797a31fdf068cb26ec0cac19724a9f4cf5ae3b49c6b5ff23617ba2cab75aa607e32cae7768af82d7ffd3b2c3d0b0894b2f2ca3bcc27fc10d078a38afdcbde1e717a79ffe98d7b60f3426e845976188b28768dcc8171720a6cd7d99edec1a578c93bfe11cc999f72e74f5075543e6e5792cdfcf3e789c3958100aeee79fe8152026bdba0a844a2cf147a41ae942178a4775e6d47664cf1dd22760783f901d90ead65ab65d1b94512a7efd19d0780e0000000000001da4c8c73fe7b12417617d0e69f22284358dbee748254a766bf509e2084c85affea4d105e0223146ad824d763931dd9dabed046ae4238389d13f9feb23a3b266c33409a975"], 0xb5)
ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000100)={0xfd8, 0x1, 'client0\x00', 0xffffffff80000000, "9de89704ff9c66b9", "c5856ee0b4a9e70eff3af31204bbf6b18b12465af607d6b2ea1c623567760630", 0x0, 0x10000})
connect$rose(r1, &(0x7f00000000c0)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3391.766215][T32371] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:40 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:40 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000600)='/dev/audio\x00', 0x84843, 0x0)
ioctl$IMCLEAR_L2(r1, 0x80044946, &(0x7f0000000480)=0x78ce)
write(r0, &(0x7f0000002000)='/', 0x1)
r2 = shmat(0xffffffffffffffff, &(0x7f0000000000/0x4000)=nil, 0x2000)
shmdt(r2)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000640)=ANY=[@ANYRES16=0x0, @ANYRESOCT=r0, @ANYPTR=&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYRESHEX=r0], @ANYRESDEC=0x0, @ANYBLOB="18d760129c2e6f14913efc7958592b7c10e10a884a1afea91b67ea5b04b8f39c37dc8dd1ca82f76536a78601cf26e78c859a29c82e2667b7b61254c3f2bf61b83124ba804d218ac4ad29d32acb74ee8580fa290e685fadb645b41de1980b9128b10f288825ef6230f111a7b6d56170ffeed1ad014c14045ea94e2d250df97a60c1ad5022fbafef61107cf587b869e004caba2e3b82a257c02b682aa1ff283a98aab8ba3901c346cec302d5bfd3343bdbd48514ef13d24267ba03d973bc780b2beb077e98a8be95f7", @ANYRES32=r0, @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="2d43136991b8725a408878", @ANYRESOCT=r0, @ANYPTR64, @ANYRES16=r0, @ANYRESDEC=r0, @ANYRESDEC=0x0, @ANYPTR64, @ANYRES32=r0], @ANYRES16=r0], @ANYRESDEC=r0, @ANYPTR64=&(0x7f0000000340)=ANY=[@ANYPTR=&(0x7f0000000180)=ANY=[@ANYRESHEX=r0, @ANYRES16], @ANYRESHEX=r0, @ANYBLOB="1e913924ff9b9e1dd9f313fa3822e147f6b4cf1a41725a42ada947ac8c297f081304721e7ef024f94e2646e5b0cf857a77febd70bfe966e10f13f69d2a3386e931c71af6be58787598c37f0123fdd5df77226677bc4ed2ff719ab7474586aa6c2ac9b826e46d4911b80c565d94e9fb8fb0999d5838c4b2d25bde6aabf85925c22f6e98f7389d21698a1fb400646f734884c7d5ebb4a54e1587de2c903415f65d18efcc1a6e813b946d5ca84b65e44d2bf1b3845d48c0137defc755aeb411bcff4a80e15d2fc36815e055b61510ba7f7c8d663de7a98ee84ab7515376dc0e14af89257cf0292115f0c9b4e5c0a6d1c62db1a92628aa", @ANYRES16, @ANYRES64=r0], @ANYRESDEC=r0, @ANYRESDEC=r0], &(0x7f0000000000)='./file0\x00', 0x0, 0x5010, 0x0)
ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000004c0)={0xb5, ""/181})

10:12:40 executing program 4:
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4)
connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000000)=0x1, 0x394)
sendmmsg(r0, &(0x7f0000002580)=[{{&(0x7f0000000140)=@hci, 0x80, &(0x7f00000003c0), 0x0, &(0x7f0000000880)}}, {{&(0x7f0000000400)=@sco, 0x359, &(0x7f0000000a80), 0x26c, &(0x7f0000000c40)}}], 0x4000000000002f0, 0x0)

10:12:40 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:40 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="c0dca5055e0bcfec7be070")
futex(0x0, 0x87, 0x0, 0x0, 0x0, 0x0)

10:12:40 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4000000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:40 executing program 0:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000200)="c0dca5055e0bcfec7be070")
pipe(&(0x7f00000000c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
r3 = socket$inet_udp(0x2, 0x2, 0x0)
close(r3)
write$cgroup_int(r2, &(0x7f0000000080), 0x294)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r1, 0x0, r3, 0x0, 0x8100000, 0x0)

10:12:40 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x10000, 0x0)
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f00000000c0)={<r2=>0x0, 0xe6d4, 0x30, 0x1000000000000, 0x1f}, &(0x7f0000000100)=0x18)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000000140)=@sack_info={r2, 0x9bf, 0x9}, &(0x7f0000000180)=0xc)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3391.969757][T32601] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:40 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x8000, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f00000000c0)={[0x9, 0x7, 0x5, 0xba85, 0x7fff, 0xbe, 0x7, 0xd4a7, 0x0, 0xffffffffffffff56, 0x8, 0x1, 0x101, 0x7ff, 0x8, 0x100000001], 0x15002, 0x40})
name_to_handle_at(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={0x98, 0x9, "698ae5a60d355e70f963fe8cdc76d5290693c1015708e1e8493ac01ebf5ba06f12aa3ca3beca8642d9d55567241a88ba6ce0b06abe5dbc836127acd153c56a383bfc017685b4f359abfec8e73f3d0407d6824dce413fff001fb8225d9be2df67f9c685cb592275a865ab3871d7c0412fb0d44224b451f0ab482221bb2df4118cc2d37c200cd76415a23f8fbe62fe18c4"}, &(0x7f0000000240), 0x400)
ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000280))
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3392.023429][T32766] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:40 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4800000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:40 executing program 4:
pipe(&(0x7f00000000c0)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
close(r2)
write$cgroup_int(r1, &(0x7f0000000080), 0x294)
syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00')
splice(r0, 0x0, r2, 0x0, 0x8100000, 0x0)

10:12:41 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
fcntl$dupfd(r0, 0x406, r0)
fcntl$getownex(r0, 0x10, &(0x7f0000000140))
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = dup(r0)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000000)={0x5, [0x0, 0x0, <r2=>0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x18)
setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000100)=@assoc_value={r2, 0x7f}, 0x8)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3392.183885][T32715] device nr0
 entered promiscuous mode
10:12:41 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:41 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x4c00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:41 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = dup2(r0, r0)
getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000000), &(0x7f0000000040)=0x4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
lseek(r0, 0x0, 0x3)

10:12:41 executing program 0:

10:12:41 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000000200)="2f563e10a4175a31da046834cb65dbb5748d248f483b2e366a5591e1febf2c629134c642e8155df0a6b86a4917f694390f9424914c93f1a8e0da15430f824a9a2a53146c82d41b72a3602740677617f2e13d7d67dacceec063326c4955a5e156d769c4e0344ef62b002cabaa5021257a83f307d2b3fe61c28fef5fef07fa9eecf0056b0d78a01dc518f32c5c09", 0x8d)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
write$binfmt_script(r0, &(0x7f00000002c0)={'#! ', './file0', [{0x20, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}, {0x20, '/dev/loop#\x00'}, {}, {0x20, '.lo(\\self:posix_acl_accessusermd5sumw:'}], 0xa, "4fda8df0b3e439f05f43c6ad2aa31c130c08d7fba23e04b948c70d0ca2f64396f56ee916db589795820ad77a6e6bebfd8ca5a358d0b30b0fa5fa49b111363fb468a2c527ed5513316c"}, 0xc8)
mount(&(0x7f0000000000)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x4, 0x2)
ioctl$BLKRESETZONE(r1, 0x40101283, &(0x7f00000000c0)={0x4, 0x1000})

10:12:41 executing program 4:

10:12:41 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070")
r1 = socket$inet(0x2, 0x2, 0x0)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4)
sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000cd2ff0)={0x2, 0x4e21}, 0x10)
setsockopt$sock_int(r1, 0x1, 0x40, &(0x7f0000000180)=0x1, 0x4)
recvmmsg(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, 0x0}}], 0x4000000000001b8, 0x12001, 0x0)

10:12:41 executing program 0:
r0 = socket(0x11, 0x800000003, 0x0)
setsockopt$packet_buf(r0, 0x107, 0xf, &(0x7f0000000000)="a2e6fa9a", 0x4)
read(r0, &(0x7f0000000140)=""/174, 0xae)
bind(r0, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80)
write$binfmt_aout(r0, &(0x7f0000000100)={{0x107, 0x0, 0x0, 0xd, 0xf0ffff, 0x0, 0x0, 0x0, 0x8}}, 0x20)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.stat\x00', 0x0, 0x0)
epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000200)={0x50000008})
syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)

10:12:41 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6000000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:41 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x4, 0x40000)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000140)={0x7, [0x0, 0x0, 0x0, <r2=>0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000180)=0x20)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000240)={r2, 0x38, &(0x7f0000000200)=[@in6={0xa, 0x4e20, 0xffffffff, @rand_addr="d4d7cbb305409774ea8f7b7459f4e02a", 0x40}, @in6={0xa, 0x4e22, 0x40, @mcast2, 0x7fffffff}]}, &(0x7f0000000280)=0x10)
r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/snapshot\x00', 0x0, 0x0)
r4 = socket$inet_udplite(0x2, 0x2, 0x88)
dup2(r4, r3)
write(r0, &(0x7f00000000c0)="2fe6cf31b246fabe28547eba505ce5fd51b42fe7bd72099ece506b19dd17826eea4622d0be3d7f265275563ef908b73674385702e0cbea38244687a250d9972f1d974b0ad6a639fe8ee59a03ca24f74dec3ddd769709471abc0a629e284b2ad923f6cd39f487e670cf04833cc6614e", 0xffffffffffffff13)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x400)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:41 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10)

10:12:41 executing program 2:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x10000, 0x8)
getsockopt$MISDN_TIME_STAMP(r0, 0x0, 0x1, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x1)
write(r1, &(0x7f0000002000)='/', 0x1)
sendfile(r1, r1, &(0x7f0000000040), 0x7f)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0)
mount(&(0x7f0000000180)=ANY=[@ANYRESOCT=0x0, @ANYRES32=0x0, @ANYRESDEC], &(0x7f0000000140)='./file0\x00', 0x0, 0x5010, 0x0)

[ 3392.900609][  T817] skbuff: bad partial csum: csum=0/65535 headroom=2 headlen=22
[ 3392.932917][  T717] device nr0
 entered promiscuous mode
10:12:42 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070")
r1 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c)
sendmmsg(r1, &(0x7f00000002c0), 0x400000000000174, 0x0)

10:12:42 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x40)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={<r2=>0x0, r1, 0x0, 0xc, &(0x7f00000000c0)='/dev/media#\x00'}, 0x30)
syz_open_procfs(r2, &(0x7f0000000140)='clear_refs\x00')
write$P9_RFLUSH(r1, &(0x7f0000000040)={0x7, 0x6d, 0x2}, 0x7)
prctl$PR_SET_THP_DISABLE(0x29, 0x0)

10:12:42 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000000), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
fcntl$dupfd(r0, 0x0, r0)

10:12:42 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6800000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:42 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x6c00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:42 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x10000, 0x0)
setsockopt$inet_udp_int(r1, 0x11, 0x6f, &(0x7f0000000040), 0x4)

[ 3393.576660][ T1014] device nr0
 entered promiscuous mode
10:12:42 executing program 0:

10:12:42 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040)=0x3, 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/4\x00')
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={<r2=>0xffffffffffffffff, r1, 0x0, 0x1, &(0x7f00000000c0)='\x00'}, 0x30)
syz_open_procfs(r2, &(0x7f0000000140)='syscall\x00')
ioctl$PERF_EVENT_IOC_RESET(r1, 0x2403, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000580)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x4008, 0x0)

10:12:42 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7400000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:42 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
stat(&(0x7f0000000580)='./file1\x00', 0xffffffffffffffff)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, <r1=>0x0}, &(0x7f0000000240)=0xc)
syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000040)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000100)=[{&(0x7f00000000c0)="b160998be1ef1a03352526153d85522f29070560f9bd24345778766eaa371739e7a30746", 0x24, 0x5}], 0x2, &(0x7f00000005c0)=ANY=[@ANYBLOB="657874656e745f63616368652c6e6f666c7573685f6d657267652c61636c2c64697361626c655f726f6c6c5f666f72776172642c6e6f666c7573685f6d657267652c6f626a5f726f6c653d2b62646576292f2f766d6e657431a93a776c616e312c6673636f6e746578743d757365725f752c61756469742c736d61636b66737472616e736d7574653d766d6e6574312c657569643d", @ANYRESDEC=0x0, @ANYBLOB="2c6f626a5f747970653d757360722c666f776e65723cdf5365c54c7b5e7c54482b433a3ce4800cd84eee5ff010bb96eb4957e50147c3f581651ffbdf05c386487d7571be94bbb5577876cbd2c7def09188e91980c13b4e396f660c0c", @ANYRESDEC=r1, @ANYBLOB=',smackfsfloor=lo}lo,\x00'])
r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm-control\x00', 0x80, 0x0)
ioctl$VIDIOC_SUBDEV_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f00000003c0)={0x0, @reserved})
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:42 executing program 4:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070")
r1 = socket$inet_sctp(0x2, 0x5, 0x84)
setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000080), 0x4)

[ 3393.832563][ T1427] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 3393.840828][ T1427] F2FS-fs (loop3): Can't find valid F2FS filesystem in 1th superblock
[ 3393.849758][ T1427] F2FS-fs (loop3): Magic Mismatch, valid(0xf2f52010) - read(0x0)
[ 3393.865417][ T1427] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock
10:12:43 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:43 executing program 0:

10:12:43 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40)
ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r1, 0x80dc5521, &(0x7f0000000340)=""/181)
r2 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x81, 0x0)
ioctl$SIOCX25SSUBSCRIP(r2, 0x89e1, &(0x7f00000000c0)={'lo\x00', 0x6, 0x5})

10:12:43 executing program 4:

10:12:43 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x7a00000000000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:43 executing program 0:

10:12:43 executing program 4:

10:12:43 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x9effffff00000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3394.486400][ T1691] device nr0
 entered promiscuous mode
10:12:43 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x2586c634, 0x2000)
ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000140)={{0x4173, 0xa4}, {0x2, 0x2}, 0x7ff, 0x7, 0x2})
getsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
setsockopt$inet_mreqsrc(r1, 0x0, 0x27, &(0x7f0000000200)={@local, @rand_addr=0x1488, @rand_addr=0x7}, 0xc)

10:12:43 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0)
getsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000000), &(0x7f0000000040)=0x4)

10:12:43 executing program 0:

10:12:43 executing program 4:

10:12:43 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:43 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xf0ffffff00000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:43 executing program 0:

10:12:43 executing program 4:

10:12:43 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
accept4(r0, 0x0, &(0x7f0000000000), 0x80000)

10:12:43 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x0, 0x48081)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f00000000c0)={0x2, 0x6a8, 0xc9e, 0x0, 0x1, 0x401, 0x81, 0xfffffffffffffffd, 0x903, 0x1, 0x2, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8, 0x8})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:43 executing program 4:

10:12:43 executing program 0:

[ 3395.037152][ T1885] validate_nla: 16 callbacks suppressed
[ 3395.037161][ T1885] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:43 executing program 2:
r0 = memfd_create(&(0x7f0000000100)='eth1&)\x00', 0x1)
r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000040)=0x5, 0x4)
syz_emit_ethernet(0xff7e, &(0x7f0000000240)={@local, @broadcast, [], {@mpls_uc={0x8847, {[{0x3, 0x8, 0xd3e, 0x2}, {0x0, 0x4, 0x1000, 0x1000}, {0x4, 0x2, 0x400, 0x1}, {0xfffffffffffffffe, 0x0, 0x9f, 0x2}, {0xffffffffffff0001, 0x3, 0x1, 0xfffffffffffffff9}, {0x6000000000000, 0x9, 0xf1}], @ipv4={{0x10, 0x4, 0x5, 0x5, 0xce, 0x65, 0x3, 0x7, 0x33, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, {[@ssrr={0x89, 0x7, 0x8, [@multicast1]}, @timestamp={0x44, 0x14, 0x2, 0x3, 0x727a, [{[@multicast2], 0x1}, {[@loopback], 0xf17}]}, @rr={0x7, 0xf, 0x1000000000, [@broadcast, @broadcast, @multicast2]}]}}, @igmp={0x37, 0x2, 0x0, @multicast1, "1334f6e76689482c3628085bdad2edb722f4f9d3d4e72d61b9387ab0a34c5cbc44f7b7e116d7db90d09bf37909ad6acf704c5340485c265814b45674b9037490a4472813080a209d4b61e33f6f9f47f513fcbbfec63f6f8c59b080f9043a5ff07d8754750cf4dfc4cd191c6f52164064323b3c1b6e8b5000d1946098ce33ec77e8e28dce9615"}}}}}}, 0x0)
ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='veth1\x00')
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3395.104853][ T1935] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:44 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xffffff7f00000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:44 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:44 executing program 4:

[ 3395.293845][ T1931] device nr0
 entered promiscuous mode
10:12:44 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:44 executing program 0:

10:12:44 executing program 4:

10:12:44 executing program 3:
arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x9)
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x2)
ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000140)={0x2, 0xfffffffffffffff7})
connect$nfc_llcp(r1, &(0x7f00000000c0)={0x27, 0x0, 0x0, 0x6, 0xffffffffffffffc0, 0x6, "4b3cea25b8ade4ca7ed9e1bc6fad8a084ffbd3ce21746f2cc98beee45cf3cf94e120de8d065c0c78fbac31b0adcf4f76d4044c8933058dfcf288a89b3608ae", 0x1f}, 0x60)
ioctl$KVM_GET_MSR_INDEX_LIST(r1, 0xc004ae02, &(0x7f0000000040)={0x4, [0x0, 0x0, 0x0, 0x0]})
socket$inet_icmp_raw(0x2, 0x3, 0x1)

10:12:44 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write$binfmt_aout(r0, &(0x7f0000000200)={{0x1cf, 0x1ffc000000, 0x0, 0x2c9, 0x1ea, 0x3ff, 0x1f7, 0x9}, "687192aac9b8c83ac64797e7ec73f3dda0baed3e9d591813334d5d48696b92f4abbc4d4c542701708d02c53b5f69d1507ae7676b385c9cbda633fb02b8784a29e0d734be5f13ea6ed060a71a86ae57c9226b0d7cbe91fe097005a7dc885857eadaf5d7d7451a8f02fea1c196ab57c473aab02ac1bdad8fc6e8f12c618c19a3bb61301c5708015a7acc2b329714e184a48afe78e9d80c0686dc7d746a65c31cb40ea1711b660830c38ee36c4357c155aca2b8ed99e6d050568912e082ca4b515193144c4eb7cb6b9d7aa93fa1fc2158d7878aae6adaeb8831fe90194d6f86fe74e8742db9e5f68501dba8213aba6f4fe8bc37f5ef5418488f4ea15eb2c070282ecb5d4aeb31a0802d48859bb0658c95d1cffaabcebcd65337a8f29a9409959e6d379940549937f8d2b4c6f7c50574f4b4ed9d48eda65d58d888d6c534f00944c22384ae5a8de5572045bbb6f5098cacf1ad854bce79e5261f64b8c73162b3e480d27e45df6976b3f30344da8f0aea1290648b982333015e86b9e0b799713c27606623b9d82b8c1ddc1a29398988e42e5811d5e91fcb99a5a1a3df333cb8b22de587c96d1730cd1f0242db43b3d9f21dcd3508a5ac7b5786b71803ef60231b8e6fc8110a03d94b028c92a5816bd2cb1ce6b22be27f3a2eb34e2b483f552140561f6cf3dc5ec634fdf41610dd3e7c6abd4fc8f0077f3da48dbedd30f14f6ca734dcbac6894ff7abad4cb292351c9a1a151322b48f813bb4ded1b1f29753d2ea2b994407d54c6cc4a10f9214018a8421ee79a883d290d170f75865a6aa5b1ca7bc7193e278e85051b9e4f881ad00417be2586713e89d6eb5312a06dac05dae3d1515623f2f14864120ed66fc9fb3a45690853bc0bce338828ae640608d43fa9ddebe4cb2d8ec4b3472ec887e1c1702428ca247ce8ef235c84ac310152bf201d20e0e2f46934832b60776024afabaea107b505095452ca82fd69008eab8cc0c31dcf8c20ce0eac60a598458da999bb7e78f391ff3d2c8b16912eb7ebf060d8576867d16ce83eb8194a980795de05337a5e4e01de4dcb56acdbbda728b7b4302981eccf13a0b6e876d671ba149734811c153d695a85f701f4801365f9315ff67ec6ca8276e03474da751587af19493742bc2b223f272b038f4f5a09fac6171118396d6eed53cb7865672d20187e164ca6b8f79a988d1cd0099e1088556346d7069aaadb6b1fe1a3deee27aafa18a25e9440ee50f0d0eecebda79c9df0090a94942c3c71e7b15551b31543ead382692b7ee52cc5b959f7e4aa30dfac24eb30c204704af27f5281cd88ce98f7ec70a357eaec3bb937a140d2e59d56c2fc97c5c6dcf904dcf9674afa25c22dad4e279c2b61ec141835b2f13ec2591126510730bd7df48f65dd8ccfe54ce462c14b8488ff2b4ce9853ffee4e8527364c60ad9a9905658b6ca98bfc0d8289d0fdb6b53f5535206653d596e687c50d24801f91aa96649f301ce7a0ab39bc22d594dbe0fee8ca84d21ed40aee3e7600f57da1ba46b6d3ca4a2ea6005039e435e90cb17deadddbcfd35ec7f555795c14144f03f2d74d0cfe484a3f33d7c978ade5939abb72ce88867dcd6245333ace1bbf946c46f45d1014dd52ede5597bb08de90bdde18b15cb37bc6c4bf00ce6c6128abae45793423a7360e5aed37df0d00487057c6f4ef488029f6bc30f9396d209b7ef693f24b87294c326fbc38f9b4e4e473b68cf7d20b2fe54cb0e8b7aac322c43633a6126745f95dd0ef45b487a485e1119918127764e64828fc4eccb01c69e91564240aa4a6100c2fedfe74821058d9e38975a6885a981b5dc01efb8a43c5919d9e76e824b861218285fb581ad911e927d5ab82d627ef3d9500fba685ca3ce0d5354e2ee845e5101e8ed57f66fd21f806fdb820e7e5bb7ab681382b5bb06a0105c972cc1ed76fa9bc499d364dde7c430b699773ae80f60d5ddf29fa4f7117ae34527afbbdabaf42ea53b668d80e120743a8501da6989d2c601455f959270a62d89b73f529c98610eaa4288a8923c38e58b41c6bc5eaec9ec096d80a17e89b10c0d5bb0ddbf5e33b0551dc229d085b5836691f4640dfc8179d3330ab07a76c818273cf978c66375c6734723e196de866bf09b60f4de62b16238a494da921e5559d467448d47bd5313a985ed08a38eaf2d101d4c7629f825bb5679f4f4777bdaf9cd0213b6d65439cf8472759f5b015f33eebc6130386a48549c848fc86dd32331f78ecec40542c6ea3629dbb8bc2be9fb220b9c71e1382cea54e8dca67b97096ce11c751b14e3e72455f40f8f3844d79dc611d781f70ddd4d705b805a29eb0c444f48430e9e88407cbd7d9ed86019e60ebf262598865e8d1303b029a40381d79d16f4cbb7ad33d3016c0196987ac85ab3de07a21d2e6b6cc0d5a0970104a75188e97d1813c85df6132c3c4449192b6f45a7c9ce7f6545dc00139b50fdf7ec4449f0ad86517521dad467b98d85610760d3f608c70e43fe20e11264530aa7a8684050472fa32e51c397110c2184aa97a65bd543b63915495dbfd7b81883daad459f97504205e9bdbc4bb61a088f43c6c216629d7f3468d4a905dd10ed22d18844c26e4fe2d590ce475648f8cc0910cbe43cc378b5441269c456ae22f4dc7f5bbd3f3d63b6e7d3e1fa2ac93c31fdab083542043b84fac49598c32545acb4cc925eb08534932308092605ad25dc2dec487d899f0876a68c9261908b77e6fb7b2e273a63a114a9f6d76076015aa69977220246799802491365df3c14efb6519f1ad8b64b0bc88f9428073059a80474e9c9d8082160b801222832d305cbe13c5a930fb46c5784a9395a74823c7928d1de18617fcef187efda47e8db19c74e1ff50735e98b355b64a7a50dca239a0ce646e08ef48216048d51f83ecc0491ad9f0d5ba4b3b78520759848fab2dc99e2e9098f31ab318bb44f026a37907fc0cb83050bdee9525b154698de9b1c4d01f2830158f3345ecf44c038423080fadcd25e276624b9a40806fd02657d6ddb9b2b976a2f89cd5d89d9dfe0f99c51a3bd30a8788502034418f15b4ffe651d369be407b52bc54c6ce665cc8d505dc3893cee4a000f7a75186dcc7ce8537c97b96630a226642a4a46ff13f5e123c2b55fdd002130808fe362efb4162cfa8a3430237fee9676b89ec8228dbf9d7176788cda032e5ff50d2851656e568963a4ef51a4a3415541a2ceda91ef0a08c66e7732651d2b52b5b577739aa83423ae4955ddb060c9e750ba13f12e5389d01365e26abb9c118e986877719b29ccea470b6a0949dac6cb7da04b7d860586bb75490d4e2d96dad54ed82158b7dd2971dc3e9e490c462c8b65dfd4f21a6a5944b8c0ad81a00b9a2c6a98437c8d737212fbd9418c1c607cf6cec1fafc5b411c475f245526f41f0544b0cf201d9f8fc29c9d45536cac4d736e3b9b65a0c44d5a2ff804422e23beb58ff9ee349c4ebcf59ad5a7a5bc5646ff16e54c3dedcdb1dfe5acaa2abaad43affde3a467adfce7e7d7dc4d8bf190daac2a65c3931ee7ea79acc5beaf79dcd84b80f4263dd35b4595c9c477239d6907ef76dd7fad30c70bfbe9eaf33067379f1f707d7c056fef3be6e2683c6fd1d8ff954e54fc2f1076e3bc9a02ea5d459301ffe4c006061fbabde7b2d744bf8b6f2f85db66a18ad82a9c4cf51d1b1136ea85355ada310ca3012f3ee12ff7858676fe75f237cda713dfa7b87159b85765982b3c34c04f6b0a4d7e11ff5283e3478e86527aba5e1b5a801ac46a51c8ded239bc6ed89a8178801dd0da64411201ef09dd2895755b00acd2ef912cd42dc4143730537e4d24eec0b60ae539cb15514420a6bf0d832e4c04e00ff438ca55a2828eb46e663a9ef145f4cbb445631985c6e545aede86b102f186dbc7e0742ef149213953312c6807ac1042397711e3f44b5ee48d77464093243828d3e6268701608cb308fef052971afd44f34f6582ad9697dac5839ac7c20583e51d09a41d9b4cd2fa2f16dd375f1ec48d10b624371b81c48297769c5fce28ac795b59284fd0998e9d8f7ae98ef2ef468125af990c6db5d92bdb77fca80c9d930c38054fa62aeba4a2502ba8af4141bc14ca66baaf9507c562138cefd440995dd74e256434ed9fe3a014ebe332d0b6834d050c76bbd127ac0088eb78e6feff85a48b50ae4e602e85e3b3766e97b4b889fc606e6b7377d05b63bbb95d2116082b104f9ef97996f24fbad229a6c6abd9775222f0120ce1bfe20bab3c27359b4c8710121369b9407ae5eb8a5eaea7cfa28049786425c79a9e9694a88ecd9109ccf96a72327c5411170a137487657bdde2e02ec3a88dcc4357a68bc9ee4a2e4065ccdc2aa0f9903d5bda47d8a9280174beec6abcf957300f2c277e2495d9715646083d39d674d4b1f75910038b9cda322a6d41431fd14ced39a17e146cf996bfbafb426a10a3ca74a555f99c58f30218fbd979eea042be7802ea39f0a527d7c0b72478afcd5118f42909c546d493f5f3fb57458a266924c05dcf697b7b8c6d0afa52d042222888f2bcace25b621d848a002ec385bb4733d5d72dfbd6eb4415aa945f416eba27c2d90ffc97987c08c82c63873c0fa121ddc02478a2348d88c1202cf33cbd73b8f0de1b7b51e345bda0b5b91d627554256ba849570e80ffbaae53a29111764c92eadcd2cfe913f5b3bc52bfd6dea43e47ce9831bec921f7b5b17fbdf1d5678efd2f4ed20c14f1048c3b74343080218dba7e5622a188265e5a2af2fb9ab44a3028497930667ab050fee11d668942b54bb9691f10dce68749cc2ffe6b5340276aa7d2ac79eda97c04bf90b0bdfeef91d09351610c7f1a7c361fb6079be0f68293bede0b4bfc1950cedd86f58445352fd4056c99b8aba03be333611da074b29fb27639bd4ffa5ee3640a7f5d517b7780dc2f953ecbe88859580b29221d0c66c9d562711e7a797e277e9a855666a929a82969bcca9f71102487514962893bd66174d60f7ca4c48d8d18c05878a479f948332f8a188b1c043c5c2cbc9f3a5da9b223a3869a2d2c0b85ee966f66dd9ef280e1c009ba37358ba27117c9c57dcf257d9db7dec0e8ec91f3c7be618af71014c5799adfee31deb75019392888fb4442948b46faf83c0d2be7d4062acc7345131970f8c2e70fc50e097ee207ad16d1fc74329fcb812923506eedc5a911df9a16e9b536eb2a5305b798c733fff57d99288f8a60d0ac3b5357c4a5389475f4069cf0d9c3cd0b32ca21ae293f33cdfec27f0ca4a8b764f2c9ae2cd8be668c8be2b8d270ff63735fcd0ecbddfbc93a5893e58823a6a33b93c484e04d5a2425fb96fb070c94da7408b469234f555a3d7bde59f7fa415ee6d464b8e4b77c4544b9cfc5fccb98966c4b0d40091985ca52ca75bb1b71bc2147c56e78665ae0b6bdcefee364f956785dc72903f6c9044003c51e0dada7a49919b7cfcd07ab3a432d4cbadec79e7a7802388a211e7b89de8d7e33cd877e6a79fb6a82c2fd0ebaeee1a55eba96b9f7ee44504b8e2aa28259cc5e84bb5fab5ad494b7f9d804bc3a34c683f5753abc0037fd3ff34547249e456703b501a4e6e585be3667f6bc2503a73326febbb64909b7f24dc47ab61ed02b900fa851cd18223cfe71ad7a72ad0a5d99574078cac60dc8c741d950f8f908bcd1dfcc0a227a42acdd610949138a6eac86384724b61b7407afbaae41bb000362c005f1198ec5ea9f267122043700d54bdf82b10d2dfd67db169175a09b17199ae5b96c6e78730556e567aaf1a41399e21ccd42f5984a06faed2f", [[], [], [], [], [], []]}, 0x1620)
write(r0, &(0x7f0000002000)='/', 0x1)
fchdir(r0)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = socket$isdn_base(0x22, 0x3, 0x0)
ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000000)={'netdevsim0\x00', 0x2})
r2 = fcntl$dupfd(r0, 0x406, r0)
ioctl$TUNSETLINK(r2, 0x400454cd, 0x32f)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3395.632758][ T2019] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3395.651053][ T2112] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:44 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0xfffffffffffff000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:44 executing program 4:

10:12:44 executing program 0:

[ 3395.819805][ T2122] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:44 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000000100)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f00000000c0)={0x8000000, 0x80, 0x31})
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:44 executing program 4:

[ 3395.890951][ T2192] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:44 executing program 0:

10:12:44 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3396.038446][ T2180] device nr0
 entered promiscuous mode
[ 3396.437111][ T2239] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3396.457556][ T2240] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:45 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:45 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x3b, &(0x7f0000000000), 0x0)

10:12:45 executing program 0:

10:12:45 executing program 4:

10:12:45 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
sync_file_range(r0, 0x3, 0x2, 0x4)

10:12:45 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:45 executing program 0:

10:12:45 executing program 4:

10:12:45 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f00000002c0)="2f1272e7f3947857c6a2e2f25293f6d1f092d12e7734a349a201bdb2d5b4cccde040a178597da625c7713ede78d77873529a810215af5578feb5b27675ce9fddd33ab0b3cb183eee428db2af2d142b962b006ac43cd34da1e07ea740699fd7eb8cd58506e7c178754a439d43abacd19d39559c2e1fe7eb331a422a07cf31bea926ccf8c292edbd70", 0x88)
sendfile(r0, r0, &(0x7f0000000000), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000280)=ANY=[@ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYPTR=&(0x7f0000000380)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r0, @ANYRES64=r0, @ANYPTR64, @ANYBLOB="6bdc030a1e516d9a9ca4df24a367d9d4c614eebd8a27dc1821b8cede6f077dc891b71f258800176ffa158e92677e6a047e39d4cdfb8a1bcc83bf9e7b0da731399b80164f86f2d194b92124b4d9befc8a003c4b640c82d569e68d469efc3cf36f2d178d56aef0845302beecc751a0ac776a7522ca0f879334e429538cdcb83ddfc3c66c83f3c10ba792ec411981ed1bace2caa1c6f40fed5bddf4b7c67f943a60489d02b3525defdb7975aaa6749f97f5e3e9dca9c39f1daf1611aff15894d0eea23c202c1c6e89c70dbe848665bfc143cd379968191eec46"], @ANYPTR64], @ANYPTR64, @ANYRESDEC=r0, @ANYRES32=r0], &(0x7f0000000080)='.', 0x0, 0x80005010, 0x0)
r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock\x00', 0x101000, 0x0)
ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000200)={0x2, 0x0, [{0x7, 0xc7e6, 0x1, 0x2, 0x3, 0xffff, 0x5}, {0x6, 0x2, 0x1, 0x800, 0x1, 0x4, 0x7ff}]})
r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00')
sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r2, 0x0, 0x70bd26, 0x25dfdbfd, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x8050}, 0x80)

[ 3396.650505][ T2294] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:45 executing program 4:

10:12:45 executing program 3:
r0 = socket$alg(0x26, 0x5, 0x0)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/sequencer2\x00', 0x10040, 0x0)
fsmount(r1, 0x1, 0x1)
getsockname(r0, &(0x7f00000003c0)=@can={0x1d, <r2=>0x0}, &(0x7f0000000440)=0x80)
sendmsg$inet(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="82f4ee7097e5a35d870fb9cd41dd2862fc3c1c71f2c67a8b8505143ed02040dc9345d94f5e73baa8b80744ca2c67ba517b15fc7b9943aeda33ed4b105c800216f5c0acd3d5a6c84f7280f1f9fed354647ebe80ffbe0a5176476cd01f42fb166693429259", 0x64}, {&(0x7f00000002c0)="05cb700ac5bc65641e3953a089007aa3b5a746921657633509a8d27ad75206df42a965c6c683902862158b0495c6eacb6835f3b8c4872ef82c416029723e37c66fc230a33e07c60a1c7c0c10c330a7b18dcb422097f04f1e7bdf87b39e1e2b37b15aae156088ee518a3ef66a7cf167", 0x6f}, {&(0x7f0000000000)="a5446147ce253a7d1d4f9ecf106302ec05e8907e32d6c87dc6f3e87682c0dd5b1a2860d976cea2f3d7fc18", 0x2b}], 0x3, &(0x7f0000000540)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x7}}, @ip_retopts={{0x10}}, @ip_retopts={{0xd8, 0x0, 0x7, {[@noop, @timestamp={0x44, 0x10, 0x3, 0x3, 0xffffffffffffffff, [{[], 0x1ff}, {[@rand_addr=0x7], 0x3}]}, @rr={0x7, 0x2b, 0x200, [@rand_addr=0x7f, @broadcast, @dev={0xac, 0x14, 0x14, 0x10}, @loopback, @dev={0xac, 0x14, 0x14, 0x1f}, @broadcast, @empty, @multicast1, @remote, @loopback]}, @end, @end, @end, @cipso={0x86, 0x4f, 0x5b, [{0x2, 0x11, "1812302f6b2e270b1ac918b47503d2"}, {0x0, 0xa, "15f1669bba653cd1"}, {0x5, 0xe, "8d23ee9eb69018b85ee07168"}, {0x7, 0x6, "ab983e1b"}, {0x1, 0x11, "7eb564989bb4eba0ae74bffc91c82b"}, {0x7, 0x9, "5a7d7cabbb79a1"}]}, @end, @ra={0x94, 0x6, 0xfffffffffffffff7}, @cipso={0x86, 0x30, 0x5, [{0x6, 0xc, "2d33feca878b5983e678"}, {0x2, 0xc, "b455767a6689f9e710e9"}, {0x7, 0x4, "84e1"}, {0x0, 0xe, "e5090e26e994590f1b2a0b54"}]}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_tos_u8={{0x11}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xe701}}, @ip_ttl={{0x14, 0x0, 0x2, 0x5}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @multicast2, @empty}}}], 0x198}, 0x80)
recvmmsg(r0, &(0x7f0000003440)=[{{0x0, 0x0, &(0x7f0000002040)=[{0x0}, {&(0x7f00000004c0)=""/71, 0xfffffffffffffcc1}], 0x2}}], 0x1, 0x0, 0x0)
bind$alg(r0, &(0x7f0000000340)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58)
r3 = accept4(r0, 0x0, 0x0, 0x0)
recvmmsg(r3, &(0x7f0000001bc0), 0xfe, 0x0, &(0x7f0000001d00)={0x77359400})
r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_genetlink_get_family_id$tipc(&(0x7f0000000040)='TIPC\x00')
getsockopt$netlink(r3, 0x10e, 0xb, &(0x7f0000000200)=""/88, &(0x7f0000000280)=0x58)
connect$rose(r4, &(0x7f0000000080)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c)
setsockopt$MISDN_TIME_STAMP(r3, 0x0, 0x1, &(0x7f0000000180)=0x1, 0x4)

10:12:45 executing program 0:

[ 3396.851224][ T2269] device nr0
 entered promiscuous mode
[ 3396.867508][ T2356] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:46 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:46 executing program 4:

10:12:46 executing program 0:

10:12:46 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:46 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x0, 0x0)
r2 = fcntl$getown(r0, 0x9)
write$P9_RGETLOCK(r1, &(0x7f00000000c0)={0x5d, 0x37, 0x1, {0x2, 0x2d5434c8, 0x685, r2, 0x3f, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}}, 0x5d)

10:12:46 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000040)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, 0x4, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x40)

10:12:46 executing program 4:

10:12:46 executing program 0:

10:12:46 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:46 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
prctl$PR_MCE_KILL(0x21, 0x1, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:46 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000100)={r1, 0x1e, 0x1, 0x8, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0], 0x4}, 0x20)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:46 executing program 4:

[ 3397.624192][ T2484] device nr0
 entered promiscuous mode
10:12:46 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00'})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:46 executing program 0:

10:12:46 executing program 3:
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x1a, 0x4)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:46 executing program 4:

10:12:46 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:46 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xc0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f00000000c0)="db76a7da0699cc36457833c14f8bde46001e179ac3281a56284eb40936ccce75b12fc986df278b5bf38f9b3f7cbf407676c94b8e71b241d8c7b06c8ff202775d6560dcb1d9042f52af2f6984127df51b4c3590311b45ec2a2a4f6d01aa8d67746aa3f84cd56f5cf0fe82d34d296bffac7fa88556ed81eaa9646b828d30d5c203acafc6d5c6cf9024b7cf207de7b3af43cf9369f2066302ee0d016c8b01", &(0x7f0000000200)=""/239}, 0x18)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:46 executing program 0:

10:12:46 executing program 4:

10:12:46 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:46 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, 0x1, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}, 0x1c)

10:12:46 executing program 0:

10:12:46 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f00000000c0)=0xfff)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000000), 0x4)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000000, 0x112, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3398.286286][ T2611] device nr0
 entered promiscuous mode
10:12:47 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00'})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:47 executing program 4:

10:12:47 executing program 0:

10:12:47 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
readahead(r0, 0x81, 0x100000000)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:47 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:47 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0x9)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.events\x00', 0x0, 0x0)
r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00')
sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000200)={0xbc, r2, 0x400, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8001}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x11bbffe7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xd662}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3ff}]}, @TIPC_NLA_MEDIA={0x5c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x24b}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}]}]}, 0xbc}}, 0x4000000)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:47 executing program 0:

10:12:47 executing program 4:

10:12:47 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:47 executing program 3:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f00000000c0), 0x800)
r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00')
sendmsg$TIPC_CMD_SET_LINK_WINDOW(r0, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0xd010}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x68, r1, 0x8, 0x70bd28, 0x25dfdbff, {{}, 0x0, 0x4109, 0x0, {0x4c, 0x18, {0x1, @media='eth\x00'}}}, ["", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200000, 0x0)
setxattr$security_smack_transmute(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000300)='TRUE', 0x4, 0x1)
write$apparmor_current(r3, &(0x7f0000000040)=@profile={'changeprofile ', 'vmnet0\x00'}, 0x15)
connect$rose(r2, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:47 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040)=0x6, 0x7f)
dup3(r0, r0, 0x80000)
r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x103e81, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@initdev, @in6=@ipv4={[], [], @broadcast}}}, {{@in=@local}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000300)=0xe8)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0)
io_uring_enter(r2, 0x8, 0x7, 0x3, &(0x7f00000000c0)={0x1}, 0x8)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
syz_open_dev$midi(&(0x7f0000000340)='/dev/midi#\x00', 0x6, 0x20000)
fsetxattr$security_ima(r0, &(0x7f0000000100)='security.ima\x00', &(0x7f0000000140)=@md5={0x1, "4123050ca563364d13dd53377ba1b80d"}, 0x11, 0x1)

10:12:47 executing program 0:

[ 3398.951224][ T2749] device nr0
 entered promiscuous mode
10:12:48 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00'})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:48 executing program 4:

10:12:48 executing program 0:

10:12:48 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x37ae, 0x10000)
bind$x25(r1, &(0x7f0000000040)={0x9, @null='               \x00'}, 0x12)
recvfrom$rose(r1, &(0x7f00000000c0)=""/189, 0xbd, 0x40000002, &(0x7f0000000180)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:48 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:48 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000000c0)=ANY=[], &(0x7f0000000100)='.', 0x0, 0x5010, 0x0)
r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x80000001, 0x309000)
fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x800000, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@nodevmap='nodevmap'}, {@afid={'afid', 0x3d, 0x5}}, {@access_client='access=client'}], [{@fsname={'fsname', 0x3d, 'posix_acl_access\'wlan1#/&'}}, {@hash='hash'}, {@uid_eq={'uid', 0x3d, r2}}, {@seclabel='seclabel'}, {@fscontext={'fscontext', 0x3d, 'root'}}, {@subj_role={'subj_role'}}]}})

10:12:48 executing program 0:

10:12:48 executing program 4:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000000)=0x400100000001, 0x4)
connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c)
r2 = dup2(r1, r0)
setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64)
connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r3 = gettid()
connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x0, @remote, 0xfffffffffffffffd}, 0x1c)
ptrace$setopts(0x4206, r3, 0x0, 0x0)
tkill(r3, 0x27)
fcntl$setstatus(r0, 0x4, 0x427ff)

10:12:48 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:48 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x8002, 0x0)
r2 = open(&(0x7f0000000140)='./file0\x00', 0x4001, 0x100)
syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000180)=[@textreal={0x8, &(0x7f0000000200)="baf80c66b8fc58748f66efbafc0c66b80200000066ef0f0866b9800000c00f326635000800000f3023890b21360f01efbaf80c66b8fcabfd8d66efbafc0c66ed15361866b9ae08000066b8e038000066ba000000000f30b819048ec00f01cb", 0x5f}], 0x1, 0x10, &(0x7f0000000280)=[@dstype0={0x6, 0x1}], 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
signalfd4(r1, &(0x7f00000002c0)={0x6}, 0x8, 0x80800)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000000)=ANY=[], &(0x7f0000000100)='./file0\x00', 0x0, 0x5010, 0x0)
ftruncate(r0, 0x100000000)
r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x250001, 0x0)
ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000080))

10:12:48 executing program 0:
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x0, 0x0)
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, 0x0)
getsockopt$bt_BT_SNDMTU(r0, 0x112, 0xc, 0x0, &(0x7f0000000100))

10:12:48 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x5)
recvmmsg(r1, &(0x7f0000002480)=[{{&(0x7f00000000c0)=@sco, 0x80, &(0x7f0000001780)=[{&(0x7f0000000140)=""/115, 0x73}, {&(0x7f00000001c0)=""/176, 0xb0}, {&(0x7f0000000280)=""/194, 0xc2}, {&(0x7f0000000380)=""/225, 0xe1}, {&(0x7f0000000480)=""/233, 0xe9}, {&(0x7f0000000580)=""/186, 0xba}, {&(0x7f0000000640)=""/63, 0x3f}, {&(0x7f0000000680)=""/225, 0xe1}, {&(0x7f0000000780)=""/4096, 0x1000}], 0x9, &(0x7f0000001840)=""/84, 0x54}, 0xfffffffffffffff7}, {{&(0x7f00000018c0)=@in={0x2, 0x0, @multicast1}, 0x80, &(0x7f0000001a40)=[{&(0x7f0000001940)=""/237, 0xed}], 0x1, &(0x7f0000001a80)=""/145, 0x91}, 0x9}, {{&(0x7f0000001b40)=@isdn, 0x80, &(0x7f0000002040)=[{&(0x7f0000001bc0)=""/151, 0x97}, {&(0x7f0000001c80)=""/206, 0xce}, {&(0x7f0000001d80)=""/129, 0x81}, {&(0x7f0000001e40)=""/39, 0x27}, {&(0x7f0000001e80)=""/105, 0x69}, {&(0x7f0000001f00)=""/161, 0xa1}, {&(0x7f0000001fc0)=""/117, 0x75}], 0x7, &(0x7f00000020c0)=""/221, 0xdd}, 0x800}, {{&(0x7f00000021c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f00000023c0)=[{&(0x7f0000002240)=""/139, 0x8b}, {&(0x7f0000002300)=""/143, 0x8f}], 0x2, &(0x7f0000002400)=""/82, 0x52}, 0xfffffffffffffffd}], 0x4, 0x40, 0x0)
ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000040)=0xffffffffffffff9c)
fcntl$getflags(r0, 0x1)

[ 3399.717091][ T2930] device nr0
 entered promiscuous mode
10:12:48 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:48 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:48 executing program 0:
sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x9)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/netlink\x00m\x10\x1bDv\xe5j@\xca\x98\"X\xc7k\xb9u\x17w\xed*\xb23\xa9#\xcb\x12\x97\xe9U\x18\xd4\x8d\b\xfc\x845j\x18z\r\xd6\xea\xacE\xd3G\xa9Ki(\xf3\xa3\xfa\xf1\x11(b\am\xd21\x91Q\xbe}\xa3\x8b\r\xc2TR\xa9\tm\x1f\x12hf\xc6\xfa!\x8eK\xd9\x90K\xfa\xc1\x1d\xa9i\x17\a\xdb+\x95Z /\xc9\xafk\xb3!\x05\x17\xcb\x05\tX\x9c~\x85O\x97\x8f\xcc\xcc\xe4\xcb=\xdb\xdf\x1a\x81N\x01>\xdb7\xe3\xe3\xae;3\x8fF\x18\xa4Y `nu\xab!\x9dG\xea\x06\xa7\x83\t\x9b<\x10\xad\a\xb5Ia\xb4f\x97\xb7a4!\xe5h\xabk\x7f\xc4\x9d8\xdb>')
preadv(r0, &(0x7f0000000940)=[{&(0x7f0000000500)=""/112, 0x70}], 0x1, 0x4c000000)

10:12:48 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
write$binfmt_script(r0, &(0x7f0000000200)={'#! ', './file0', [{0x20, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}, {0x20, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}, {0x20, '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}], 0xa, "162293d2371839f890cd2895b876643263a4dc19436dca869ff06119cec8ccfbc3d10ce4fd2fde8b613bf01eaab6c2237382a5e1e47ad42b2dc12929386b73334e7dbde8418e464dce"}, 0x114)
ioctl$VIDIOC_G_OUTPUT(0xffffffffffffffff, 0x8004562e, &(0x7f00000000c0))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:49 executing program 3:
r0 = open(&(0x7f0000000000)='./file0\x00', 0x2c8000, 0x100)
ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000040))
connect$rose(0xffffffffffffffff, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:49 executing program 4:
r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0)
r1 = socket$vsock_stream(0x28, 0x1, 0x0)
r2 = syz_open_dev$usbmon(&(0x7f0000000580)='/dev/usbmon#\x00', 0x0, 0x0)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000100)={0x0, 0x9, 0x1, 0xb57d, 0x200})
pipe(&(0x7f0000000180)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in=@multicast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0, <r6=>0x0}}, {{@in=@local}, 0x0, @in=@remote}}, &(0x7f0000000040)=0xe8)
getgid()
write$P9_RLOCK(r1, 0x0, 0x0)
fstat(r3, &(0x7f0000000500))
getresgid(&(0x7f00000002c0), &(0x7f00000005c0), &(0x7f0000000600))
getegid()
r7 = syz_genetlink_get_family_id$fou(&(0x7f00000006c0)='fou\x00')
sendmsg$FOU_CMD_DEL(r3, &(0x7f00000007c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x40, r7, 0x0, 0x70bd26, 0x25dfdbfb, {}, [@FOU_ATTR_LOCAL_V6={0x14, 0x7, @mcast2}, @FOU_ATTR_PEER_V4={0x8, 0x8, @remote}, @FOU_ATTR_PEER_PORT={0x8, 0xa, 0x4e21}, @FOU_ATTR_IFINDEX={0x8, 0xb, r5}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000010)
getgid()
getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, <r8=>0x0}, 0x0)
write$P9_RSTATu(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="8b0000007d000000006500000000000000a201000000060000000000000000008800f400000000000000200000000000000011002f6465762f76686f73742d76736f636b0007002a657702110866637d748368312d400d002f6465762f7573626d6f6e23000d002f6465762f7573626d6f6e230011002f64", @ANYRES32=r6, @ANYRES32=0x0, @ANYRES32=r8], 0x84)
write(r4, &(0x7f0000000340), 0x10000014c)
socket$nl_xfrm(0x10, 0x3, 0x6)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000240)={0x0, <r9=>0x0})
ioctl$FS_IOC_ENABLE_VERITY(r2, 0x6685)
pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r9+30000000}, &(0x7f0000000300)={0x0})
vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0)
fsetxattr$security_evm(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3)

10:12:49 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x900, 0x0)
lsetxattr$security_evm(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.evm\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="040f68a50e0000ffa7e78bd0c32c131bc06b0117000000000000"], 0x15, 0x3)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x85010, 0x0)

[ 3400.249516][ T3245] validate_nla: 16 callbacks suppressed
[ 3400.249526][ T3245] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:49 executing program 0:
sendmsg$alg(0xffffffffffffffff, 0x0, 0x0)
memfd_create(0x0, 0x0)
pwritev(0xffffffffffffffff, 0x0, 0x0, 0x881806)
r0 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000001380)=[{&(0x7f0000003040)="02", 0x1}], 0x1, 0x0)
fallocate(r0, 0x20, 0x0, 0xfffffeff000)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, 0x0, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f0000000240), 0x0)
socket$unix(0x1, 0x0, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
fallocate(r1, 0x0, 0x0, 0x10000101)

10:12:49 executing program 3:
r0 = fcntl$getown(0xffffffffffffff9c, 0x9)
ptrace$getsig(0x4202, r0, 0x400000000405, &(0x7f00000000c0))
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x0, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0xfffffffffffffd97)

[ 3400.344173][ T3369] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:49 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:49 executing program 4:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xc0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f00000000c0)="db76a7da0699cc36457833c14f8bde46001e179ac3281a56284eb40936ccce75b12fc986df278b5bf38f9b3f7cbf407676c94b8e71b241d8c7b06c8ff202775d6560dcb1d9042f52af2f6984127df51b4c3590311b45ec2a2a4f6d01aa8d67746aa3f84cd56f5cf0fe82d34d296bffac7fa88556ed81eaa9646b828d30d5c203acafc6d5c6cf9024b7cf207de7b3af43cf9369f2066302ee0d016c8b01", &(0x7f0000000200)=""/239}, 0x18)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3400.532456][ T3343] device nr0
 entered promiscuous mode
10:12:49 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x400, 0x40000)
getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000040)={<r2=>0x0, 0x7}, &(0x7f00000000c0)=0x8)
setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000100)={r2, 0x3}, 0x8)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c)
fsetxattr$security_evm(r1, &(0x7f0000000140)='security.evm\x00', &(0x7f0000000180)=@sha1={0x1, "dc685d5eae95f05c293472f215d5b8d77f8c06b5"}, 0x15, 0x3)

[ 3400.699944][   T27] audit: type=1800 audit(1559643169.499:9430): pid=3433 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor.0" name="bus" dev="sda1" ino=17208 res=0
[ 3400.987602][ T3574] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3401.010033][ T3805] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:49 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:49 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x10000, 0x0)
write$P9_RFSYNC(r1, &(0x7f00000000c0)={0x7, 0x33, 0x2}, 0x7)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:49 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:49 executing program 4:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xc0, 0x0)
bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r1, &(0x7f00000000c0)="db76a7da0699cc36457833c14f8bde46001e179ac3281a56284eb40936ccce75b12fc986df278b5bf38f9b3f7cbf407676c94b8e71b241d8c7b06c8ff202775d6560dcb1d9042f52af2f6984127df51b4c3590311b45ec2a2a4f6d01aa8d67746aa3f84cd56f5cf0fe82d34d296bffac7fa88556ed81eaa9646b828d30d5c203acafc6d5c6cf9024b7cf207de7b3af43cf9369f2066302ee0d016c8b01", &(0x7f0000000200)=""/239}, 0x18)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:49 executing program 3:
connect$rose(0xffffffffffffffff, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
prctl$PR_SET_FPEXC(0xc, 0x40000000040000)
r0 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8, 0x80000)
ioctl$PPPIOCDISCONN(r0, 0x7439)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000380)=[@in6={0xa, 0x4e21, 0x3, @remote, 0xfe00000000000}, @in6={0xa, 0x4e20, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xf8}, @in={0x2, 0x4e22, @local}], 0x48)
r1 = gettid()
sched_getattr(r1, &(0x7f0000000000), 0x30, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={<r2=>0xffffffffffffffff}, 0x13f}}, 0x20)
write$RDMA_USER_CM_CMD_QUERY_ROUTE(r0, &(0x7f0000000340)={0x5, 0x10, 0xfa00, {&(0x7f00000000c0), r2}}, 0x18)

10:12:49 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:50 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x400200, 0x0)
openat$cgroup(r1, &(0x7f0000000040)='syz0\x00', 0x200002, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:50 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x200, 0x0)
ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x8)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:50 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3401.322870][ T3863] device nr0
 entered promiscuous mode
[ 3401.346456][ T3924] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:50 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:50 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@short={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x1, @default}, 0x1c)

10:12:50 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
memfd_create(&(0x7f0000000000)='T:prockeyring-system\x00', 0x2)
syz_open_dev$usb(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x81, 0x20000)
syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0x5, 0x200)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3401.834130][ T3928] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:50 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:50 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$KVM_GET_XCRS(r0, 0x8188aea6, &(0x7f0000000000)={0x1, 0xcc2, [{0x7ff, 0x0, 0x6}]})
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x28)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x10e)
setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f00000000c0)={0x41, 0x1, 0x2}, 0x10)

10:12:50 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
fremovexattr(r0, &(0x7f0000000000)=@random={'security.', '\x00'})
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:50 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:50 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:50 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:50 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:50 executing program 2:
r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x9, 0x80000)
ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f0000000100)={0x5, &(0x7f00000000c0)=[{}, {}, {}, {<r1=>0x0}, {}]})
ioctl$DRM_IOCTL_SWITCH_CTX(r0, 0x40086424, &(0x7f0000000140)={r1, 0x3})
r2 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r2, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r2, &(0x7f0000000040)=0x2, 0x7e)
sendfile(r2, r2, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r2, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:50 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000040)=0x400)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3402.197645][ T4155] device nr0
 entered promiscuous mode
[ 3402.218218][ T4173] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:51 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:51 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)

10:12:51 executing program 3:
syz_emit_ethernet(0x2e, &(0x7f0000000000)={@link_local, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @multicast1}, @igmp={0x11, 0x0, 0x0, @empty, "35800008"}}}}}, 0x0)
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

[ 3402.761861][ T4300] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:51 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
prctl$PR_SET_PDEATHSIG(0x1, 0x40)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
openat$smack_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
timer_create(0x3, &(0x7f00000000c0)={0x0, 0x2a, 0x6, @tid=0xffffffffffffffff}, &(0x7f0000000100)=<r1=>0x0)
r2 = fcntl$dupfd(r0, 0x2, r0)
getsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000180), &(0x7f0000000200)=0x4)
renameat2(r2, &(0x7f0000000240)='./file0\x00', r2, &(0x7f0000000280)='./file0\x00', 0x7)
timer_gettime(r1, &(0x7f0000000140))

10:12:51 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)=<r1=>0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@loopback}}, &(0x7f0000000040)=0xe8)
lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
r4 = openat$dsp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/dsp\x00', 0x400000, 0x0)
r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000340)='TIPC\x00')
sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r5, 0x100, 0x70bd25, 0x25dfdbff, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x4}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000005}, 0x80)
setsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={r1, r2, r3}, 0xc)

10:12:51 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:51 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:51 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:51 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local, <r4=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2, <r11=>0x0}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty, <r12=>0x0}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00)={0x11, 0x0, <r13=>0x0}, &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={<r16=>0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1, <r18=>0x0}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp={0x2c, 0x0, <r19=>0x0}, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci={0x1f, <r20=>0x0}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r21=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1, <r23=>0x0}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote, <r24=>0x0}, &(0x7f0000004d40)=0xc)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000005740)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000005700)={&(0x7f0000004d80)={0x950, r2, 0x400, 0x70bd28, 0x25dfdbfb, {}, [{{0x8, 0x1, r3}, {0x74, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r4}}}]}}, {{0x8, 0x1, r5}, {0x60, 0x2, [{0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xffffffff, 0x8e75, 0x9, 0x1}, {0x0, 0xd5, 0x7, 0xa3c}, {0x5, 0x8, 0x20, 0x1}, {0x63, 0xfff, 0x800, 0x100}, {0xf0, 0x6, 0x7d8, 0x4}]}}}]}}, {{0x8, 0x1, r6}, {0x1c8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x6, 0x1, 0x9, 0x4}, {0x40, 0x100000001, 0xffffffffffff0001, 0x3}, {0x3, 0x6ad1694, 0x1e34, 0xffffffff000000}]}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}]}}, {{0x8, 0x1, r9}, {0x11c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7f}}}]}}, {{0x8, 0x1, r12}, {0xc8, 0x2, [{0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r13}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}, {{0x8, 0x1, r14}, {0x1b4, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x100000000}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x39}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r17}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x190, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xff}}, {0x8, 0x6, r20}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r21}}}, {0x5c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x2c, 0x4, [{0xfd98, 0x401, 0x1, 0x6}, {0x7, 0x0, 0x4, 0x6}, {0xfff, 0x6, 0x9, 0x1f}, {0x3a, 0x81, 0x5, 0xa403}, {0xfffffffffffffffb, 0x4, 0x2, 0x3}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x81}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r24}, {0xf4, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x950}, 0x1, 0x0, 0x0, 0x41}, 0x48801)

[ 3402.940823][ T4692] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3402.974093][ T4709] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:51 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1}, &(0x7f0000002e80)=0xc)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000004d00)={@multicast1, @remote}, &(0x7f0000004d40)=0xc)

10:12:51 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000000), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000100))
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x10, r0, 0x0)
mount(&(0x7f00000000c0)=ANY=[@ANYRES64=r0, @ANYRES16=r0], &(0x7f0000000080)='.', 0x0, 0x4, 0x0)

10:12:51 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:51 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x800, 0x0)
sendmsg$nfc_llcp(r0, &(0x7f00000007c0)={&(0x7f00000000c0)={0x27, 0x1, 0x0, 0x7, 0x7f, 0x1f, "1c66f5476dbe8692ac341bae187acaf3abdc918ceafc1b1cfbf471b5978f539fb608a7adf6aec18f43cd8224c786381be91125a7777f05e9b56069a4cffb13", 0x2d}, 0x60, &(0x7f0000000680)=[{&(0x7f0000000140)="75f8439aa04de7e8521ab4aa413acf05c80b6cf04f874d07e028f62583794d6538694c9ee6818c1a5d22cddef19acee488bf2cd45b91b87cd1a942619e874a2e4e7f9cb47d431bcc0f85369170475494b0540400253962ffe016c76e0db295959e2d238c95fab6e185f72d2a69572cba78eec3cb61149d386a05730dbb24f6ff63ed2a371a04819762b14bbdf83ed998917cd3af6ce6d59e0ccf96b55a21b5ddcd4a3cbdb75a83a11e5f3e239e7c39b861bcf002cddf2c954f60d2f7a597b1e776b54eeab45bd8c381f7eaf938a15afdd6e0c335ceb6d01487e18529b9c88bbf556167fbfc11f930f49a84af97edc45ad3dbaa61", 0xf4}, {&(0x7f0000000040)="485ff5edf361dfe405416ed61d41fb79fe37f0ff803e6c51617dc18c89b914", 0x1f}, {&(0x7f0000000240)="2995bcb0d08154e40ec87d14d4774ce8401ac62f4f1ec994a55da25b758ad85ec6a640813c8a0fadcd74311174ecfe6ca5291304f3565fdf779caa1bc7d036abe02ff445648fc7099db47b61bc551c58345d803c13a4d40e001e711bbdaab7ec7bf2d2722e5668a0ee6e9b7510", 0x6d}, {&(0x7f00000002c0)="e75b27bf1d81e7562b436fb8e7750ad5e938510750077b5d9b51caa004213906aa58a06944d64de00478f7f8484685c5fc09bca373a8554cc47f7a91a71041fa53f6d7d2520c4efae23881f44a82bfc5bbf7", 0x52}, {&(0x7f0000000340)="084a290ef02d55e818d5430c69b88f492c55853bab942d531eb2408ca1cf32a4c360f6794fbc40f1308b040a74c95fa0e213c71588dc235e626e45a5ae8513eaa16d0f953c567d65f067835726b0d8acc4f3097b9e1b1dcbdc1ef9dfefdb56731da1ee5c2c95be4587af7fd645ab2a369df4b47cc88741cff4aa78d978712705e8cb5723113cf803b022505f8a702f156a57d3758e03", 0x96}, {&(0x7f0000000400)="36454f59e0f98a78dd3e5b9f05f3a7d707dab95ae36c4112de28cdc2ca2c2d8c31339448faae094bd067f3dfc1b2d3b385900c7ba8985ce5b7d0619c770302040250ce196552ffd9747a03900df2af2acb7df2267214cf2d21441090e18f2fe07b466d60b1fcc852703b241a538575e1e4711179f0650c2f99c7fdbe5c132a8724a5d9c1c3da4526f99fc2f963efb0f43c127fb0404b6c5d241de77c1c9c6c8680ecd7021960108759c916ff3d38fc21e3652f9ee6266de8774dd2cb0a0c4d7a77490881", 0xc4}, {&(0x7f0000000500)="6b1a5470779a2d16fbd1b97e8e86c91bcdf07c99bd135bdd8de6a56dc9a68b0e3cdf638a990a82bacd2c9a785ab6de7966658de3accb50cefa1d4be51b3a40b0694e669bf3a3d87afbac775f16893018540d839bfdfb7a7e8036ce80fadb20f751bfac", 0x63}, {&(0x7f0000000580)="3e182cf9d75da74ded05682a47039dfb8882095e65bf00c00d2724ee5484dcfd33591f5c36ad4e5578f7d4e7759974acca9c6716476fc498a06a38ce0fb2ab05f1efb93262a2951fcf7dafa99b7f94d23afb80b7cea96281406d878c3519c75e6135648ecffd792a07b09206fe17b9f1ac3535b9391b3c53b3f4c1aae99c620dc4acae80d3e3afd46c6d5f823b0197f388bbbce79f5d57d27d2eb811863e0020f32523bd83b2c11028a4b8f1550005a4ee4cc93c5d5b4dc12b8c7bc46acc55fe058c6992f1193729476d2203f5ec66bd68e529", 0xd3}], 0x8, &(0x7f0000000700)={0x90, 0x10f, 0x7fff, "757195f3e705a473ca05b7106eb498f58b663b6cfc4db94269af30bc40012d000c132c2412beeb053c742440a333c3a5d34fcecf52d5d1c04e593f95ff38a45abdef3030d6777ff764e288dfadf78f64ac908e48e0f1d41242159e6853a2a441d0a15331dab349619bd27cd8337e21edc7aa9c44291a4d179d7a4046a5"}, 0x90, 0x4000000}, 0x4000000)
r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r1, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:52 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)
getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002e40)={@broadcast, @multicast1}, &(0x7f0000002e80)=0xc)

[ 3403.203496][ T4704] device nr0
 entered promiscuous mode
10:12:52 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:52 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:52 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x4002, 0x0)
ioctl$TIOCGDEV(r1, 0x80045432, &(0x7f0000000140))
r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x400002)
ioctl$SNDRV_TIMER_IOCTL_STATUS(r2, 0x80605414, &(0x7f00000000c0)=""/19)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:52 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
connect$rose(r0, &(0x7f0000000000)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x9, 0x80801)
ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000100))
r2 = open(&(0x7f0000000040)='./file0\x00', 0x40000, 0x2a)
ioctl$VIDIOC_G_INPUT(r2, 0x80045626, &(0x7f0000000080))

10:12:52 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)

10:12:52 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:52 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = creat(&(0x7f0000000000)='./file0\x00', 0x2)
ioctl$TCSETA(r1, 0x5406, &(0x7f00000000c0)={0x100, 0x397, 0x3f, 0xe4ba, 0xe, 0x8, 0xfffffffffffffbff, 0x2, 0x4, 0x5})

10:12:52 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_mount_image$nfs(&(0x7f0000000040)='nfs\x00', &(0x7f00000000c0)='./file0\x00', 0xff, 0x7, &(0x7f00000006c0)=[{&(0x7f0000000100)="8b0c556af333983acec7eb1af4299fb989c88f42703024db89f73449c6d44778abb87f86f6510d57521ff8e3419fe5276a86517419ed0488ca3e36db27c28b99cee8d36dd6bab8334e9e4f8fd67fa7fa715f5e1d2d05ad48b93b5ea4fb259064f956f03fd92a71e040c6e6", 0x6b, 0x7e3}, {&(0x7f0000000180)="19bf6034fe57ad401018e6d4d872c2ca7d74282b73f5fe9aa6bbf16077f84a6ff88a499245951a3a76c9c9af4be6d0c40a5f22021478dccacfc42580c26e62ab3edcc3fec89ba67e3bef4808ed482370f82fbb5bae25b8667f70e1f6d68997845364294c68781a3b279019ea216ed75a9a8e2a6738fe99d6a3fc49af0919c6106f7d4ce8559c6f6d41102a8a9dc2f7f8614e8eee339a350ef3ad9d190cdf3819c89f05995002edb1e8b25a757068ec9942ad53949b7e7249e7c86d9b683c3247077a", 0xc2, 0x4}, {&(0x7f0000000280)="8e32f1a6e3adc2da1990038fa8023025c7170260d9eda50001265652933bf693e78c248430a71b9aa62c2f303628df2556d19b76cb62d5cd117684b390eb4b68f415f29e2f6d002e160c1a766806ddfc501a14d4e586efef90321430b06a22da49efb4054a47193e4a5f1b5293ef5ad075016e0909d601f4e1d6a2f9795b65a97dbbb4e56efef0f31ecd97100bb044e68f91ec49bde976a2d2e204bd4af7353fb2ee02e39d3434c87d7e776305f25b81cd7d9afbe4b9295578b34ebf26d02aa204618164650229dc9a5e71f55f2b941ae2e62b3d49218548842fa3f4ed14b3003151c50ffb", 0xe5, 0x20}, {&(0x7f0000000380)="42cf521cfaa369813956215a1b14aac20d5d3243b764ff81a8e35dc85167f8c45ddd3971bbcd63f1485b08a2419c3b8eeb2291532358cbcd203d3ad0ed416d8865954d7055b3c6a1d83f762f246379fdfd279d018a1afdc2", 0x58, 0x9}, {&(0x7f0000000400)="d18b30905e9b4412485b04b7e14b505290c969961e02e742bb41a723ded163bf86e9cad5ba4e1222774cc687049b79f78e14ea356f585e49e20172d5219d888dd0e1c503255fbbaa3018b05452ccefbd4cc15dcc63695f0b8867ebcafd56fabbe49ef1301266fa2e0c2cbe120fc40c7e4069244b7dc980cca8c488787bc8c79bf09feec78423efc71040069f98270d9bdd668362ead374", 0x97, 0x2}, {&(0x7f00000004c0)="c9ad549424e127284ea77f6631eeb1c55a4f3380d2e83d3d697ac41cc780889319ae81660aa7e24dd12b0ff1262f461eeed766056d08c40e7ec45b5296e9f6d5dcd24a8298c0ab5f0290e495bf42d421f02e1e7117f0c3e1be9f5fe386920acaa2d6c3e4c5943969c74d44c92e9534a80b7680b7196381057ff1d4237495ba71f35383b69180997fdcd4e7bb43cd7931649fb619d156f93e7fba3d12f2f2b634d2a2d6b46abbd0e623c11eb012e95ad42d74d839d5dbf5c48e29aa5f2fbd6ec935f69b491177e0374fe5fa77f71ede2e0664debee7e0e518b141474b771e", 0xde, 0x3}, {&(0x7f00000005c0)="26b987d357cd9da55f1b744122009a1caa7c6a91eeb8045fd337a833bee0c4f6144f34915ed75cec97089d28c1e3934712e30bc683dc48e3b06515cb4dabb54e5082382222a41a957bcf47b9e9d9236a6b2947b3d355ec8c84a13c7d196b80e853340257a04aa3d6c58debc3f1854bb4ea86ba5a155eaafa1d2408194871eec434ea664a3fd9b605e0ae1f7465e42116094b9e6849f52727f7e79ca1d0d35ef18a1e4e687039302b16d757ac823ea547e4a4f14ba9f425f613baba9eed044b6742acac0520937d8922161aaecf9ffd526b46ebe3e57501d47780d86cffff09", 0xdf, 0x6}], 0x4000, &(0x7f0000000780)='/dev/snd/pcmC#D#c\x00')
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)
syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x1, 0x840)

10:12:52 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:52 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:52 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)
getsockname$packet(0xffffffffffffffff, &(0x7f0000002dc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002e00)=0x14)

10:12:52 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)

10:12:52 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:53 executing program 2:
r0 = memfd_create(&(0x7f0000000200)='\x00\xac=\xd4\xa4\xc6\xd4\xcco\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xafo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x400000000000)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000000c0), 0xfec)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4, 0x32130, r0, 0xfffffffffffffffd)
poll(&(0x7f00000001c0)=[{r0, 0x4080}], 0x2000000000000100, 0x18005)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:53 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)

[ 3404.329990][ T5192] device nr0
 entered promiscuous mode
10:12:53 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x1)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:53 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:53 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:53 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:53 executing program 2:
r0 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000)
accept$unix(r0, &(0x7f00000000c0), &(0x7f0000000140)=0x6e)
r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r1, &(0x7f0000002000)='/', 0x1)
sendfile(r1, r1, &(0x7f0000000040), 0x7f)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
lgetxattr(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)=@random={'os2.', '\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f'}, &(0x7f0000000280)=""/111, 0x6f)

10:12:53 executing program 0:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)

10:12:53 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:53 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:53 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7fffffff, 0x40000)
ioctl$sock_rose_SIOCRSCLRRT(r1, 0x89e4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:53 executing program 0:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)

10:12:53 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:53 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3405.128847][ T5383] device nr0
 entered promiscuous mode
10:12:54 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:54 executing program 0:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000d00)={0x0, @dev, @broadcast}, &(0x7f0000000d40)=0xc)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000d80)={{{@in6=@initdev, @in6=@empty}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@local}}, &(0x7f0000000e80)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x0, &(0x7f0000000ec0)={@multicast2, @multicast1}, &(0x7f0000000f00)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)
recvmmsg(r0, &(0x7f0000002bc0)=[{{&(0x7f00000013c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000001640)=[{&(0x7f0000001440)}, {&(0x7f0000001480)=""/93, 0x5d}, {&(0x7f0000001500)=""/191, 0xbf}, {&(0x7f00000015c0)=""/31, 0x1f}, {&(0x7f0000001600)=""/29, 0x1d}], 0x5, &(0x7f00000016c0)=""/42, 0x2a}, 0x2}, {{&(0x7f0000001700)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001780)=""/65, 0x41}], 0x1, &(0x7f0000001840)=""/218, 0xda}, 0x7ff}, {{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/212, 0xd4}, {&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/67, 0x43}], 0x4}, 0x1}], 0x3, 0x40000000, 0x0)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000002c80)={{{@in=@initdev}}, {{@in6=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000002d80)=0xe8)

10:12:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:54 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4)
connect$rose(r0, &(0x7f0000000080)=@full={0xb, @dev, @default, 0x600, [@default, @default, @bcast, @null, @null, @netrom]}, 0x40)

10:12:54 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f00000000c0)='/', 0x2ac)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0)
recvmsg$kcm(r1, &(0x7f0000000180)={&(0x7f0000000100)=@in={0x2, 0x0, @local}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/107, 0x6b}, {&(0x7f0000001300)=""/203, 0xcb}], 0x3, &(0x7f0000001400)=""/203, 0xcb}, 0x40000040)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000240)=ANY=[@ANYRESDEC, @ANYRESDEC=r0], &(0x7f0000000200)='.', 0x0, 0x5010, 0x0)

10:12:54 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000bc0)={{{@in=@initdev, @in=@loopback}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, &(0x7f0000000cc0)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3405.587313][ T5407] validate_nla: 12 callbacks suppressed
[ 3405.587322][ T5407] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:54 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:54 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000a80)={{{@in=@broadcast, @in=@broadcast}}, {{@in=@multicast1}}}, &(0x7f0000000b80)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:54 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0xfffffffffffffee0)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x100, 0x0)
getsockopt$inet6_tcp_int(r1, 0x6, 0x12, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
timerfd_create(0x9, 0x80000)

10:12:54 executing program 3:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(r0, 0x89e4)

[ 3405.634422][ T5411] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:54 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:54 executing program 3:
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

[ 3405.888562][ T5412] device nr0
 entered promiscuous mode
[ 3405.915259][ T5424] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3406.172602][ T5430] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:55 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:55 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000a00), &(0x7f0000000a40)=0x14, 0x800)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:55 executing program 3:
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

10:12:55 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x101001, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r1, 0x4040aea0, &(0x7f00000000c0)={0x8ec1, 0x3ff, 0x1f, 0x0, 0x40, 0x7f, 0x7f, 0x800, 0x108b, 0x40, 0x2, 0x0, 0x0, 0x7fff, 0x2, 0x0, 0x1, 0x1, 0x4e})

10:12:55 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:55 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:55 executing program 3:
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

10:12:55 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000980)={@empty}, &(0x7f00000009c0)=0x14)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3406.385521][ T5438] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3406.419421][ T5445] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:55 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = syz_open_dev$usb(&(0x7f0000000340)='/dev/bus/usb/00#/00#\x00', 0x7, 0x20c040)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000500)=ANY=[@ANYRESOCT, @ANYPTR64=&(0x7f00000004c0)=ANY=[@ANYRESDEC=0x0, @ANYRESDEC=0x0], @ANYRESHEX=r1, @ANYRESDEC=r1, @ANYRES64=r1], &(0x7f0000000480)='./file0/file0\x00', 0x0, 0x100000010080, 0x0)
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='9p\x00', 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="7472616e733d7463702c706f1ba54be317127215e00872743d3078303030303030c77af0f83030346532302c646566636f6e746578743d73797374656d5f752c7065726d69745f646972656374696f2c636f6e746578743d756e636f6e66696e65645f752c6d61736b3d"])
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000380)={<r2=>0x0, @in6={{0xa, 0x4e23, 0x39, @ipv4={[], [], @local}, 0x7}}, 0x401, 0x4}, &(0x7f0000000080)=0x90)
setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000580)={r2, 0xff, 0x5}, 0x8)
setxattr$trusted_overlay_upper(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0xbd, 0x3, 0x5d1c, "2d40b9beb111efaff06a30786160e225", "48009a0798bfa40ddb6b76b368ec75551cbd453c7310a95767e0cbfb56338762ccbf3c1975ba0bd20426247a7fbece5cf59ef6736362c3a9dc50deb95cf76ae653dea49d703266c0032d0f452bcc702c3b3654bf34583a205822dd349e01cf15df040c06f07ed45fc96775f9b4bc6aead75e74beb00101bbeafdae7de720c52488ec7170ca8b980111daeec518a0bc258c39cdbea8ac44a3f763432e785922100ab9b69b671095b4"}, 0xbd, 0x2)

10:12:55 executing program 3:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

10:12:55 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ff"], 0xf)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:55 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3406.658012][ T5449] device nr0
 entered promiscuous mode
[ 3406.665970][ T5459] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:55 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:55 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getsockopt$inet_mreqn(0xffffffffffffff9c, 0x0, 0x24, &(0x7f0000000900)={@empty, @multicast2}, &(0x7f0000000940)=0xc)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3406.982395][ T5465] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:55 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x14d0, 0x20000)
ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f00000000c0)={{0x2, 0x1, 0x8, 0x0, 0x7ff}, 0xffffffffffffffff, 0x4, 0x4})

10:12:55 executing program 3:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

10:12:55 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:55 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:55 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:55 executing program 3:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
ioctl$sock_rose_SIOCRSCLRRT(0xffffffffffffffff, 0x89e4)

[ 3407.175445][ T5477] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:56 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:56 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3407.288362][ T5478] device nr0
 entered promiscuous mode
[ 3407.303718][ T5483] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:56 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:56 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:56 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:56 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:56 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
mkdir(&(0x7f0000000000)='./file0\x00', 0x80)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:56 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:56 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:56 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000007c0)={{{@in6=@loopback, @in=@remote}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f00000008c0)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:56 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
accept4$packet(0xffffffffffffffff, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000780)=0x14, 0x80800)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:56 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:56 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x208c00, 0x0)
ioctl$KVM_DEASSIGN_DEV_IRQ(r1, 0x4040ae75, &(0x7f00000000c0)={0x9, 0x8, 0x9, 0x200})
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x84080, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0)

10:12:56 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000600)={{{@in=@multicast1, @in=@dev}}, {{@in=@dev}, 0x0, @in6=@mcast2}}, &(0x7f0000000700)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:57 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3408.155848][ T5712] device nr0
 entered promiscuous mode
10:12:57 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:57 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:57 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:57 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:57 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000480)=0x14, 0x800)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:57 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:57 executing program 3:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:57 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000300)={{{@in6=@remote, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:57 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:57 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:57 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = open(&(0x7f0000000000)='./file0\x00', 0x400000, 0x10)
ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f0000000100)={0x0, &(0x7f00000000c0)})
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
write$P9_RWSTAT(r1, &(0x7f00000000c0)={0x7, 0x7f, 0x1}, 0x7)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:57 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3408.857649][ T5844] device nr0
 entered promiscuous mode
10:12:57 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x800)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)

[ 3409.037557][ T5849] device nr0
 entered promiscuous mode
10:12:58 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, 0x0)
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:58 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000280)={@local}, &(0x7f00000002c0)=0x14)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:58 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:58 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0xffffffe5)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x200)
getsockopt$kcm_KCM_RECV_DISABLE(r1, 0x119, 0x1, &(0x7f00000000c0), 0x4)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:58 executing program 3:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x2000000, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:58 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in, @in6=@loopback}}, {{@in6=@remote}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:58 executing program 3:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:58 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00')
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3409.905099][ T6090] device nr0
 entered promiscuous mode
10:12:58 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:58 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:59 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00'})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:59 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x6, 0x400)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:59 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
ioctl$FIGETBSZ(r0, 0x2, &(0x7f00000000c0))
sendfile(r0, r0, &(0x7f0000000000), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:59 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:59 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:59 executing program 3:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:12:59 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(r0, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3410.649392][ T6217] validate_nla: 19 callbacks suppressed
[ 3410.679981][ T6217] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:59 executing program 2:
r0 = memfd_create(&(0x7f0000000000)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3410.737439][ T6226] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:12:59 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:12:59 executing program 4:
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:12:59 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='3\x00', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:12:59 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3410.934217][ T6223] device nr0
 entered promiscuous mode
[ 3410.946355][ T6275] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3410.966735][ T6339] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:00 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00'})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:00 executing program 4:
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:13:00 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:00 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f00000000c0)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_TRY_ENCODER_CMD(r1, 0xc028564e, &(0x7f0000000140)={0x2, 0x1, [0x8, 0x0, 0x5, 0x9b73, 0x9e, 0xa0, 0xff, 0x9]})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0xd0000, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:00 executing program 0:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno', 0x3d, r1}})

10:13:00 executing program 3:
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

[ 3411.458174][ T6352] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:00 executing program 4:
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3411.525279][ T6362] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3411.525314][ T6356] 9pnet: Insufficient options for proto=fd
10:13:00 executing program 0:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="00feffffffff5bd9d8030f776612ffffff000000006d6f72790000003a"], 0x1d)
getpid()
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r1 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:00 executing program 2:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='attr/keycreate\x00')
ioctl$TCGETX(r0, 0x5432, &(0x7f0000000240))
r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r1, &(0x7f0000002000)='/', 0x1)
r2 = syz_open_dev$audion(&(0x7f0000000200)='/dev/audio#\x00', 0x1, 0x100)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffff9c, 0x84, 0x10, &(0x7f00000000c0)=@sack_info={<r3=>0x0, 0xfff, 0x100000000}, &(0x7f0000000100)=0xc)
setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000140)={r3, 0xffffffffffffff7f, 0x563, 0x3}, 0x10)
sendfile(r1, r1, &(0x7f0000000040), 0x7f)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/kvm\x00', 0x0, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0)
r4 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80000, 0x0)
ppoll(&(0x7f0000000280)=[{r2, 0xc4}, {r2, 0x400}, {r4, 0x60}, {r2, 0x41}, {r1, 0x400}], 0x5, &(0x7f00000002c0), &(0x7f0000000300)={0xcdb}, 0x8)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
writev(r0, &(0x7f0000000480)=[{&(0x7f0000000380)="5ffb86bbd118ff3a58ab509a196e6a0472d72c13ea2b239565f85c12eadf6b881bd4d025165b946789f1568d42e01705b2e0707221460224b8873e5bc9346e0fbd8519d455", 0x45}, {&(0x7f0000000400)}, {&(0x7f0000000440)="fb98c59f74ed2cb4dee9b50e", 0xc}], 0x3)

10:13:00 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:00 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3411.760881][ T6361] device nr0
 entered promiscuous mode
[ 3411.782953][ T6470] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:00 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3411.882076][ T6481] 
[ 3411.883370][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3411.884464][ T6481] ======================================================
[ 3411.884470][ T6481] WARNING: possible circular locking dependency detected
[ 3411.884481][ T6481] 5.2.0-rc3-next-20190604 #8 Not tainted
[ 3411.884494][ T6481] ------------------------------------------------------
[ 3411.900450][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3411.905657][ T6481] syz-executor.2/6481 is trying to acquire lock:
[ 3411.905664][ T6481] 0000000079373888 (&mm->mmap_sem#2){++++}, at: __do_page_fault+0x9e9/0xda0
[ 3411.905702][ T6481] 
[ 3411.905702][ T6481] but task is already holding lock:
[ 3411.951037][ T6481] 00000000377240b9 (&sb->s_type->i_mutex_key#12){+.+.}, at: generic_file_write_iter+0xdf/0x610
[ 3411.961486][ T6481] 
[ 3411.961486][ T6481] which lock already depends on the new lock.
[ 3411.961486][ T6481] 
[ 3411.971898][ T6481] 
[ 3411.971898][ T6481] the existing dependency chain (in reverse order) is:
[ 3411.980922][ T6481] 
[ 3411.980922][ T6481] -> #1 (&sb->s_type->i_mutex_key#12){+.+.}:
[ 3411.989099][ T6481]        down_write+0x38/0xa0
[ 3411.993805][ T6481]        process_measurement+0x9bc/0x15e0
[ 3412.000004][ T6481]        ima_file_mmap+0x11a/0x130
[ 3412.005150][ T6481]        security_file_mprotect+0xd5/0x100
[ 3412.010992][ T6481]        do_mprotect_pkey+0x537/0xa30
[ 3412.016377][ T6481]        __x64_sys_mprotect+0x78/0xb0
[ 3412.021783][ T6481]        do_syscall_64+0xfd/0x680
[ 3412.026820][ T6481]        entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3412.033228][ T6481] 
[ 3412.033228][ T6481] -> #0 (&mm->mmap_sem#2){++++}:
[ 3412.040364][ T6481]        lock_acquire+0x16f/0x3f0
[ 3412.045405][ T6481]        down_read+0x3f/0x1e0
[ 3412.050099][ T6481]        __do_page_fault+0x9e9/0xda0
[ 3412.055409][ T6481]        do_page_fault+0x71/0x57d
[ 3412.060451][ T6481]        page_fault+0x1e/0x30
[ 3412.065148][ T6481]        iov_iter_fault_in_readable+0x1ba/0x450
[ 3412.071408][ T6481]        generic_perform_write+0x186/0x520
[ 3412.077234][ T6481]        __generic_file_write_iter+0x25e/0x630
[ 3412.083456][ T6481]        generic_file_write_iter+0x360/0x610
[ 3412.089456][ T6481]        new_sync_write+0x4d3/0x770
[ 3412.094691][ T6481]        __vfs_write+0xe1/0x110
[ 3412.099559][ T6481]        vfs_write+0x268/0x5d0
[ 3412.104338][ T6481]        ksys_write+0x14f/0x290
[ 3412.110567][ T6481]        __x64_sys_write+0x73/0xb0
[ 3412.115698][ T6481]        do_syscall_64+0xfd/0x680
[ 3412.120740][ T6481]        entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3412.127162][ T6481] 
[ 3412.127162][ T6481] other info that might help us debug this:
[ 3412.127162][ T6481] 
[ 3412.137400][ T6481]  Possible unsafe locking scenario:
[ 3412.137400][ T6481] 
[ 3412.144864][ T6481]        CPU0                    CPU1
[ 3412.150236][ T6481]        ----                    ----
[ 3412.155622][ T6481]   lock(&sb->s_type->i_mutex_key#12);
[ 3412.161096][ T6481]                                lock(&mm->mmap_sem#2);
[ 3412.168043][ T6481]                                lock(&sb->s_type->i_mutex_key#12);
[ 3412.176040][ T6481]   lock(&mm->mmap_sem#2);
[ 3412.180467][ T6481] 
[ 3412.180467][ T6481]  *** DEADLOCK ***
[ 3412.180467][ T6481] 
[ 3412.188626][ T6481] 2 locks held by syz-executor.2/6481:
[ 3412.194090][ T6481]  #0: 00000000a89dd6b8 (sb_writers#5){.+.+}, at: vfs_write+0x485/0x5d0
[ 3412.202454][ T6481]  #1: 00000000377240b9 (&sb->s_type->i_mutex_key#12){+.+.}, at: generic_file_write_iter+0xdf/0x610
[ 3412.213245][ T6481] 
[ 3412.213245][ T6481] stack backtrace:
[ 3412.219161][ T6481] CPU: 0 PID: 6481 Comm: syz-executor.2 Not tainted 5.2.0-rc3-next-20190604 #8
[ 3412.228107][ T6481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 3412.238170][ T6481] Call Trace:
[ 3412.241482][ T6481]  dump_stack+0x172/0x1f0
[ 3412.245837][ T6481]  print_circular_bug.cold+0x1cc/0x28f
[ 3412.251325][ T6481]  __lock_acquire+0x3755/0x5490
[ 3412.256201][ T6481]  ? is_dynamic_key+0x1c0/0x1c0
[ 3412.261075][ T6481]  ? mark_held_locks+0xf0/0xf0
[ 3412.265860][ T6481]  ? cmp_ex_sort+0xd0/0xd0
[ 3412.270290][ T6481]  lock_acquire+0x16f/0x3f0
[ 3412.274814][ T6481]  ? __do_page_fault+0x9e9/0xda0
[ 3412.279779][ T6481]  down_read+0x3f/0x1e0
[ 3412.283946][ T6481]  ? __do_page_fault+0x9e9/0xda0
[ 3412.288900][ T6481]  __do_page_fault+0x9e9/0xda0
[ 3412.293683][ T6481]  ? trace_hardirqs_off_caller+0x65/0x220
[ 3412.299422][ T6481]  do_page_fault+0x71/0x57d
[ 3412.303974][ T6481]  page_fault+0x1e/0x30
[ 3412.308159][ T6481] RIP: 0010:iov_iter_fault_in_readable+0x1ba/0x450
[ 3412.314673][ T6481] Code: 4c 39 f3 76 17 eb 3b e8 f4 dd 3c fe 48 81 c3 00 10 00 00 48 39 9d 68 ff ff ff 72 2d e8 df dd 3c fe 0f 1f 00 0f ae e8 45 31 f6 <8a> 13 0f 1f 00 31 ff 44 89 f6 41 88 57 d0 e8 43 df 3c fe 45 85 f6
[ 3412.334288][ T6481] RSP: 0018:ffff88808de27980 EFLAGS: 00010246
[ 3412.340369][ T6481] RAX: 0000000000040000 RBX: 0000000020002000 RCX: ffffc900081ff000
[ 3412.348359][ T6481] RDX: 0000000000000178 RSI: ffffffff83341981 RDI: 0000000000000005
[ 3412.356344][ T6481] RBP: ffff88808de27a20 R08: ffff88809bdfa200 R09: ffffed100c0930e0
[ 3412.364332][ T6481] R10: ffffed100c0930df R11: ffff8880604986fb R12: 0000000000000001
[ 3412.372412][ T6481] R13: 0000000000000001 R14: 0000000000000000 R15: ffff88808de279f8
[ 3412.380421][ T6481]  ? iov_iter_fault_in_readable+0x1b1/0x450
[ 3412.386435][ T6481]  ? csum_and_copy_to_iter+0x1600/0x1600
[ 3412.392090][ T6481]  ? kasan_check_read+0x11/0x20
[ 3412.396962][ T6481]  ? do_raw_spin_unlock+0x57/0x270
[ 3412.402094][ T6481]  ? _raw_spin_unlock+0x2d/0x50
[ 3412.406962][ T6481]  generic_perform_write+0x186/0x520
[ 3412.412266][ T6481]  ? __mnt_drop_write+0x5d/0x80
[ 3412.417142][ T6481]  ? page_endio+0x780/0x780
[ 3412.421666][ T6481]  ? current_time+0x140/0x140
[ 3412.426360][ T6481]  ? lock_acquire+0x16f/0x3f0
[ 3412.431058][ T6481]  __generic_file_write_iter+0x25e/0x630
[ 3412.437794][ T6481]  ? __sanitizer_cov_trace_cmp8+0x18/0x20
[ 3412.443536][ T6481]  generic_file_write_iter+0x360/0x610
[ 3412.449019][ T6481]  ? __generic_file_write_iter+0x630/0x630
[ 3412.454847][ T6481]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 3412.461111][ T6481]  ? iov_iter_init+0xee/0x220
[ 3412.465807][ T6481]  new_sync_write+0x4d3/0x770
[ 3412.470509][ T6481]  ? new_sync_read+0x800/0x800
[ 3412.475305][ T6481]  __vfs_write+0xe1/0x110
[ 3412.479656][ T6481]  vfs_write+0x268/0x5d0
[ 3412.483922][ T6481]  ksys_write+0x14f/0x290
[ 3412.488279][ T6481]  ? __ia32_sys_read+0xb0/0xb0
[ 3412.493079][ T6481]  ? do_syscall_64+0x26/0x680
[ 3412.497787][ T6481]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3412.503874][ T6481]  ? do_syscall_64+0x26/0x680
[ 3412.508571][ T6481]  __x64_sys_write+0x73/0xb0
[ 3412.513182][ T6481]  do_syscall_64+0xfd/0x680
[ 3412.517720][ T6481]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 3412.523635][ T6481] RIP: 0033:0x459279
[ 3412.527548][ T6481] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 3412.547168][ T6481] RSP: 002b:00007fb7af1f0c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 3412.555597][ T6481] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459279
[ 3412.563582][ T6481] RDX: 0000000000000001 RSI: 0000000020002000 RDI: 0000000000000004
[ 3412.571568][ T6481] RBP: 000000000075bfc0 R08: 0000000000000000 R09: 0000000000000000
[ 3412.579553][ T6481] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb7af1f16d4
[ 3412.587576][ T6481] R13: 00000000004c53ca R14: 00000000004deda0 R15: 00000000ffffffff
[ 3412.624635][ T6359] kobject: 'batman_adv' (000000005e5f16f7): kobject_uevent_env
[ 3412.639065][ T6359] kobject: 'batman_adv' (000000005e5f16f7): kobject_uevent_env: filter function caused the event to drop!
[ 3412.652095][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3412.654075][ T6359] kobject: 'batman_adv' (000000005e5f16f7): kobject_cleanup, parent 00000000e9cdb645
[ 3412.663564][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3412.669328][ T6359] kobject: 'batman_adv' (000000005e5f16f7): calling ktype release
[ 3412.693747][ T6359] kobject: (000000005e5f16f7): dynamic_kobj_release
[ 3412.708713][ T6359] kobject: 'batman_adv': free name
[ 3412.721060][ T6359] kobject: 'rx-0' (00000000db84681d): kobject_cleanup, parent 00000000d0d39552
[ 3412.732474][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3412.733087][ T6359] kobject: 'rx-0' (00000000db84681d): auto cleanup 'remove' event
[ 3412.742007][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3412.748396][ T6359] kobject: 'rx-0' (00000000db84681d): kobject_uevent_env
[ 3412.765793][ T6359] kobject: 'rx-0' (00000000db84681d): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3412.777591][ T6359] kobject: 'rx-0' (00000000db84681d): auto cleanup kobject_del
[ 3412.785779][ T6359] kobject: 'rx-0' (00000000db84681d): calling ktype release
[ 3412.793752][ T6359] kobject: 'rx-0': free name
[ 3412.798958][ T6359] kobject: 'tx-0' (00000000bb93e507): kobject_cleanup, parent 00000000d0d39552
[ 3412.808169][ T6359] kobject: 'tx-0' (00000000bb93e507): auto cleanup 'remove' event
[ 3412.816629][ T6359] kobject: 'tx-0' (00000000bb93e507): kobject_uevent_env
[ 3412.824337][ T6359] kobject: 'tx-0' (00000000bb93e507): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3412.835966][ T6359] kobject: 'tx-0' (00000000bb93e507): auto cleanup kobject_del
[ 3412.844127][ T6359] kobject: 'tx-0' (00000000bb93e507): calling ktype release
[ 3412.851966][ T6359] kobject: 'tx-0': free name
[ 3412.856802][ T6359] kobject: 'queues' (00000000d0d39552): kobject_cleanup, parent 00000000e9cdb645
[ 3412.866595][ T6359] kobject: 'queues' (00000000d0d39552): calling ktype release
[ 3412.874678][ T6359] kobject: 'queues' (00000000d0d39552): kset_release
[ 3412.881944][ T6359] kobject: 'queues': free name
[ 3412.887341][ T6359] kobject: 'nr0
' (000000000e40430a): kobject_uevent_env
[ 3412.894999][ T6359] kobject: 'nr0
' (000000000e40430a): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3412.905797][ T6360] kobject: 'tx-1' (000000008d6c4b28): kobject_cleanup, parent 00000000a40550a5
[ 3412.915493][ T6360] kobject: 'tx-1' (000000008d6c4b28): auto cleanup 'remove' event
[ 3412.923988][ T6360] kobject: 'tx-1' (000000008d6c4b28): kobject_uevent_env
[ 3412.931652][ T6360] kobject: 'tx-1' (000000008d6c4b28): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3412.943284][ T6360] kobject: 'tx-1' (000000008d6c4b28): auto cleanup kobject_del
[ 3412.951566][ T6360] kobject: 'tx-1' (000000008d6c4b28): calling ktype release
[ 3412.959380][ T6360] kobject: 'tx-1': free name
[ 3412.964501][ T6360] kobject: 'rx-1' (00000000ab970e7b): kobject_cleanup, parent 00000000a40550a5
[ 3412.974034][ T6360] kobject: 'rx-1' (00000000ab970e7b): auto cleanup 'remove' event
[ 3412.982416][ T6360] kobject: 'rx-1' (00000000ab970e7b): kobject_uevent_env
[ 3412.990060][ T6360] kobject: 'rx-1' (00000000ab970e7b): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3413.003257][ T6360] kobject: 'rx-1' (00000000ab970e7b): auto cleanup kobject_del
[ 3413.011469][ T6360] kobject: 'rx-1' (00000000ab970e7b): calling ktype release
[ 3413.019292][ T6360] kobject: 'rx-1': free name
[ 3413.024199][ T6478] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3413.038801][ T6359] kobject: 'nr0
' (000000000e40430a): kobject_cleanup, parent 00000000e9cdb645
[ 3413.053682][ T6359] kobject: 'nr0
' (000000000e40430a): calling ktype release
[ 3413.062619][ T6360] kobject: 'batman_adv' (00000000518d54c0): kobject_uevent_env
[ 3413.071022][ T6360] kobject: 'batman_adv' (00000000518d54c0): kobject_uevent_env: filter function caused the event to drop!
[ 3413.085144][ T6359] kobject: 'nr0
': free name
[ 3413.098420][ T6360] kobject: 'batman_adv' (00000000518d54c0): kobject_cleanup, parent 00000000e9cdb645
[ 3413.111832][ T6360] kobject: 'batman_adv' (00000000518d54c0): calling ktype release
[ 3413.120084][ T6360] kobject: (00000000518d54c0): dynamic_kobj_release
[ 3413.126784][ T6360] kobject: 'batman_adv': free name
[ 3413.135288][ T6360] kobject: 'rx-0' (00000000698f7a05): kobject_cleanup, parent 00000000a40550a5
[ 3413.144961][ T6360] kobject: 'rx-0' (00000000698f7a05): auto cleanup 'remove' event
[ 3413.155860][ T6360] kobject: 'rx-0' (00000000698f7a05): kobject_uevent_env
[ 3413.163377][ T6360] kobject: 'rx-0' (00000000698f7a05): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3413.177508][ T6360] kobject: 'rx-0' (00000000698f7a05): auto cleanup kobject_del
[ 3413.185628][ T6360] kobject: 'rx-0' (00000000698f7a05): calling ktype release
[ 3413.199938][ T6360] kobject: 'rx-0': free name
[ 3413.204717][ T6360] kobject: 'tx-0' (0000000025ce944b): kobject_cleanup, parent 00000000a40550a5
[ 3413.216802][ T6360] kobject: 'tx-0' (0000000025ce944b): auto cleanup 'remove' event
[ 3413.225051][ T6360] kobject: 'tx-0' (0000000025ce944b): kobject_uevent_env
[ 3413.235205][ T6360] kobject: 'tx-0' (0000000025ce944b): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3413.246589][ T6360] kobject: 'tx-0' (0000000025ce944b): auto cleanup kobject_del
[ 3413.257588][ T6360] kobject: 'tx-0' (0000000025ce944b): calling ktype release
[ 3413.265355][ T6360] kobject: 'tx-0': free name
[ 3413.273066][ T6360] kobject: 'queues' (00000000a40550a5): kobject_cleanup, parent 00000000e9cdb645
[ 3413.282641][ T6360] kobject: 'queues' (00000000a40550a5): calling ktype release
[ 3413.293732][ T6360] kobject: 'queues' (00000000a40550a5): kset_release
10:13:02 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00'})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:02 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, <r2=>0x0}, &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300)=<r3=>0x0, &(0x7f0000000340), &(0x7f0000000380))
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8)
syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1, &(0x7f0000000100)=[{&(0x7f0000000200)="0ade4f74b184b5db58b19efb6c65060d72a4a1a5e18cafa86200951162c8db6500712fdcb49aa15fa0f55942244f058cf5443884027b242ed6afe62d37d29d63361adaf334c0e1336a32129043d8a1c762215ebb36cdae2c317576b6e160772909093d0551bcba804ca43741414323bfcddea31504014b482e41bc0f0e6c19dae290202d73f2147f2543674bc3a7613d269a726a48b3cf09a04e0da9f8e1d5605bf12420de8d14f8da24b53f3fae0fffe36f8e5328478b2347b1a6929a2d1fe9bddd5da301939b1ad7fad80661aca33554ea4a018ec46d2100dfb75a313395c61c66e42682246b0a8b3ff000fb24edce3b2a64c466b74d13", 0xf8, 0x10000}], 0x0, &(0x7f0000000500)={[{@iocharset={'iocharset', 0x3d, 'cp862'}}, {@sbsector={'sbsector', 0x3d, 0x1}}, {@session={'session', 0x3d, 0x26}}, {@uid={'uid', 0x3d, r2}}, {@check_relaxed='check=relaxed'}, {@unhide='unhide'}], [{@fowner_gt={'fowner>', r3}}, {@uid_lt={'uid<', r4}}, {@subj_user={'subj_user', 0x3d, '#lo%security^$'}}]})

10:13:02 executing program 4:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:13:02 executing program 0:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:13:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3413.300860][ T6360] kobject: 'queues': free name
[ 3413.306115][ T6360] kobject: 'nr0
' (0000000018e7d615): kobject_uevent_env
[ 3413.316361][ T6360] kobject: 'nr0
' (0000000018e7d615): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3413.371213][ T6360] kobject: 'nr0
' (0000000018e7d615): kobject_cleanup, parent 00000000e9cdb645
[ 3413.386628][ T6360] kobject: 'nr0
' (0000000018e7d615): calling ktype release
[ 3413.391842][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3413.401542][ T6492] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:02 executing program 3:
r0 = socket$unix(0x1, 0x1, 0x0)
bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0xc)
close(r0)
syz_open_dev$midi(0x0, 0x2, 0x0)
r1 = fanotify_init(0x0, 0x0)
mount$9p_fd(0x0, &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}})

10:13:02 executing program 0:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

10:13:02 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(r0, 0x0, &(0x7f0000001380))

[ 3413.426838][ T6360] kobject: 'nr0
': free name
[ 3413.429733][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
[ 3413.433923][ T6496] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:02 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x40, 0x0)
ioctl$NBD_CLEAR_QUE(r1, 0xab05)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40, 0x8)
getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f00000000c0)={0xffff, 0x8, 0x8, 0x100000001, <r3=>0x0}, &(0x7f0000000100)=0x10)
setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r2, 0x84, 0x79, &(0x7f0000000140)={r3, 0xfff, 0x1}, 0x8)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3413.467569][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3413.489015][ T6495] kobject: 'nr0
' (00000000d7ec6b34): kobject_add_internal: parent: 'net', set: 'devices'
[ 3413.503782][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
10:13:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:02 executing program 0:
syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(0xffffffffffffffff, &(0x7f0000001300)=@xdp, &(0x7f0000001380)=0x80)

[ 3413.521098][ T6495] kobject: 'nr0
' (00000000d7ec6b34): kobject_uevent_env
[ 3413.528779][ T6495] kobject: 'nr0
' (00000000d7ec6b34): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3413.531703][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3413.551065][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
10:13:02 executing program 4:
r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
getpeername(r0, 0x0, 0x0)

[ 3413.567733][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3413.579954][ T6495] kobject: 'queues' (00000000d46b9f06): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3413.588694][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3413.602897][ T6495] kobject: 'queues' (00000000d46b9f06): kobject_uevent_env
[ 3413.605265][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3413.621720][ T6495] kobject: 'queues' (00000000d46b9f06): kobject_uevent_env: filter function caused the event to drop!
[ 3413.621936][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3413.666086][ T6495] kobject: 'rx-0' (000000005643128f): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3413.671206][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3413.687038][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3413.695336][ T6495] kobject: 'rx-0' (000000005643128f): kobject_uevent_env
[ 3413.711589][ T6495] kobject: 'rx-0' (000000005643128f): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3413.712832][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3413.722877][ T6495] kobject: 'tx-0' (00000000ccd2d466): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3413.730168][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3413.740606][ T6495] kobject: 'tx-0' (00000000ccd2d466): kobject_uevent_env
[ 3413.757843][ T6495] kobject: 'tx-0' (00000000ccd2d466): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3413.770657][ T6495] kobject: 'batman_adv' (0000000099274389): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3413.794188][ T6494] kobject: 'batman_adv' (0000000099274389): kobject_uevent_env
[ 3413.806830][ T6494] kobject: 'batman_adv' (0000000099274389): kobject_uevent_env: filter function caused the event to drop!
[ 3413.821002][ T6494] kobject: 'batman_adv' (0000000099274389): kobject_cleanup, parent 00000000e9cdb645
[ 3413.841473][ T6494] kobject: 'batman_adv' (0000000099274389): calling ktype release
[ 3413.849566][ T6494] kobject: (0000000099274389): dynamic_kobj_release
[ 3413.856437][ T6494] kobject: 'batman_adv': free name
[ 3413.864638][ T6494] kobject: 'rx-0' (000000005643128f): kobject_cleanup, parent 00000000d46b9f06
[ 3413.873818][ T6494] kobject: 'rx-0' (000000005643128f): auto cleanup 'remove' event
[ 3413.884962][ T6494] kobject: 'rx-0' (000000005643128f): kobject_uevent_env
[ 3413.892243][ T6494] kobject: 'rx-0' (000000005643128f): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3413.906580][ T6494] kobject: 'rx-0' (000000005643128f): auto cleanup kobject_del
[ 3413.914338][ T6494] kobject: 'rx-0' (000000005643128f): calling ktype release
[ 3413.924468][ T6494] kobject: 'rx-0': free name
[ 3413.929308][ T6494] kobject: 'tx-0' (00000000ccd2d466): kobject_cleanup, parent 00000000d46b9f06
[ 3413.938436][ T6494] kobject: 'tx-0' (00000000ccd2d466): auto cleanup 'remove' event
[ 3413.949122][ T6494] kobject: 'tx-0' (00000000ccd2d466): kobject_uevent_env
[ 3413.956350][ T6494] kobject: 'tx-0' (00000000ccd2d466): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3413.970155][ T6494] kobject: 'tx-0' (00000000ccd2d466): auto cleanup kobject_del
[ 3413.977903][ T6494] kobject: 'tx-0' (00000000ccd2d466): calling ktype release
[ 3413.986252][ T6494] kobject: 'tx-0': free name
[ 3413.992819][ T6494] kobject: 'queues' (00000000d46b9f06): kobject_cleanup, parent 00000000e9cdb645
[ 3414.003465][ T6494] kobject: 'queues' (00000000d46b9f06): calling ktype release
[ 3414.012891][ T6494] kobject: 'queues' (00000000d46b9f06): kset_release
[ 3414.020591][ T6494] kobject: 'queues': free name
[ 3414.025869][ T6494] kobject: 'nr0
' (00000000d7ec6b34): kobject_uevent_env
[ 3414.035230][ T6494] kobject: 'nr0
' (00000000d7ec6b34): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:02 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:02 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:02 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, <r2=>0x0}, &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300)=<r3=>0x0, &(0x7f0000000340), &(0x7f0000000380))
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8)
syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1, &(0x7f0000000100)=[{&(0x7f0000000200)="0ade4f74b184b5db58b19efb6c65060d72a4a1a5e18cafa86200951162c8db6500712fdcb49aa15fa0f55942244f058cf5443884027b242ed6afe62d37d29d63361adaf334c0e1336a32129043d8a1c762215ebb36cdae2c317576b6e160772909093d0551bcba804ca43741414323bfcddea31504014b482e41bc0f0e6c19dae290202d73f2147f2543674bc3a7613d269a726a48b3cf09a04e0da9f8e1d5605bf12420de8d14f8da24b53f3fae0fffe36f8e5328478b2347b1a6929a2d1fe9bddd5da301939b1ad7fad80661aca33554ea4a018ec46d2100dfb75a313395c61c66e42682246b0a8b3ff000fb24edce3b2a64c466b74d13", 0xf8, 0x10000}], 0x0, &(0x7f0000000500)={[{@iocharset={'iocharset', 0x3d, 'cp862'}}, {@sbsector={'sbsector', 0x3d, 0x1}}, {@session={'session', 0x3d, 0x26}}, {@uid={'uid', 0x3d, r2}}, {@check_relaxed='check=relaxed'}, {@unhide='unhide'}], [{@fowner_gt={'fowner>', r3}}, {@uid_lt={'uid<', r4}}, {@subj_user={'subj_user', 0x3d, '#lo%security^$'}}]})

10:13:02 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:02 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3414.079853][ T6494] kobject: 'nr0
' (00000000d7ec6b34): kobject_cleanup, parent 00000000e9cdb645
[ 3414.090865][ T6494] kobject: 'nr0
' (00000000d7ec6b34): calling ktype release
[ 3414.098437][ T6494] kobject: 'nr0
': free name
[ 3414.173597][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3414.187584][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
[ 3414.207199][ T6527] kobject: 'nr0
' (000000005620f780): kobject_add_internal: parent: 'net', set: 'devices'
[ 3414.236364][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3414.236885][ T6527] kobject: 'nr0
' (000000005620f780): kobject_uevent_env
[ 3414.249724][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3414.262956][ T6527] kobject: 'nr0
' (000000005620f780): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3414.269709][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
10:13:03 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:03 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:03 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:03 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x6, 0x202082)
connect$caif(r1, &(0x7f0000000140), 0x18)
sendfile(r0, r0, &(0x7f00000000c0), 0x7f)
stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
mount$9p_virtio(&(0x7f0000000180)='em0^bdev+*$\x00', &(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='9p\x00', 0x200000, &(0x7f0000000340)={'trans=virtio,', {[{@access_client='access=client'}, {@posixacl='posixacl'}, {@access_client='access=client'}, {@cache_none='cache=none'}, {@dfltgid={'dfltgid', 0x3d, r2}}], [{@smackfshat={'smackfshat', 0x3d, '/dev/dmmidi#\x00'}}, {@context={'context', 0x3d, 'root'}}, {@audit='audit'}, {@permit_directio='permit_directio'}]}})
write$USERIO_CMD_SEND_INTERRUPT(r1, &(0x7f0000000400)={0x2, 0x8}, 0x2)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x0, 0x0)
ioctl$VHOST_SET_VRING_ENDIAN(r3, 0x4008af13, &(0x7f0000000040)={0x1, 0x4})
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:03 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, <r2=>0x0}, &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300)=<r3=>0x0, &(0x7f0000000340), &(0x7f0000000380))
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8)
syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1, &(0x7f0000000100)=[{&(0x7f0000000200)="0ade4f74b184b5db58b19efb6c65060d72a4a1a5e18cafa86200951162c8db6500712fdcb49aa15fa0f55942244f058cf5443884027b242ed6afe62d37d29d63361adaf334c0e1336a32129043d8a1c762215ebb36cdae2c317576b6e160772909093d0551bcba804ca43741414323bfcddea31504014b482e41bc0f0e6c19dae290202d73f2147f2543674bc3a7613d269a726a48b3cf09a04e0da9f8e1d5605bf12420de8d14f8da24b53f3fae0fffe36f8e5328478b2347b1a6929a2d1fe9bddd5da301939b1ad7fad80661aca33554ea4a018ec46d2100dfb75a313395c61c66e42682246b0a8b3ff000fb24edce3b2a64c466b74d13", 0xf8, 0x10000}], 0x0, &(0x7f0000000500)={[{@iocharset={'iocharset', 0x3d, 'cp862'}}, {@sbsector={'sbsector', 0x3d, 0x1}}, {@session={'session', 0x3d, 0x26}}, {@uid={'uid', 0x3d, r2}}, {@check_relaxed='check=relaxed'}, {@unhide='unhide'}], [{@fowner_gt={'fowner>', r3}}, {@uid_lt={'uid<', r4}}, {@subj_user={'subj_user', 0x3d, '#lo%security^$'}}]})

[ 3414.280174][ T6527] kobject: 'queues' (000000002ad19ca6): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3414.290363][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3414.300718][ T6527] kobject: 'queues' (000000002ad19ca6): kobject_uevent_env
[ 3414.340509][ T6527] kobject: 'queues' (000000002ad19ca6): kobject_uevent_env: filter function caused the event to drop!
[ 3414.354150][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3414.362274][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3414.378077][ T6527] kobject: 'rx-0' (00000000948eaa64): kobject_add_internal: parent: 'queues', set: 'queues'
10:13:03 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140)={0x0, <r2=>0x0}, &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300)=<r3=>0x0, &(0x7f0000000340), &(0x7f0000000380))
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8)
syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x1, &(0x7f0000000100)=[{&(0x7f0000000200)="0ade4f74b184b5db58b19efb6c65060d72a4a1a5e18cafa86200951162c8db6500712fdcb49aa15fa0f55942244f058cf5443884027b242ed6afe62d37d29d63361adaf334c0e1336a32129043d8a1c762215ebb36cdae2c317576b6e160772909093d0551bcba804ca43741414323bfcddea31504014b482e41bc0f0e6c19dae290202d73f2147f2543674bc3a7613d269a726a48b3cf09a04e0da9f8e1d5605bf12420de8d14f8da24b53f3fae0fffe36f8e5328478b2347b1a6929a2d1fe9bddd5da301939b1ad7fad80661aca33554ea4a018ec46d2100dfb75a313395c61c66e42682246b0a8b3ff000fb24edce3b2a64c466b74d13", 0xf8, 0x10000}], 0x0, &(0x7f0000000500)={[{@iocharset={'iocharset', 0x3d, 'cp862'}}, {@sbsector={'sbsector', 0x3d, 0x1}}, {@session={'session', 0x3d, 0x26}}, {@uid={'uid', 0x3d, r2}}, {@check_relaxed='check=relaxed'}, {@unhide='unhide'}], [{@fowner_gt={'fowner>', r3}}, {@uid_lt={'uid<', r4}}, {@subj_user={'subj_user', 0x3d, '#lo%security^$'}}]})

[ 3414.396288][ T6527] kobject: 'rx-0' (00000000948eaa64): kobject_uevent_env
[ 3414.412353][ T6527] kobject: 'rx-0' (00000000948eaa64): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
10:13:03 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x0, 0x2000)
setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000140)=0x3, 0x4)
r2 = dup3(r0, r0, 0x80000)
pidfd_send_signal(r2, 0xc, &(0x7f00000000c0)={0x3d, 0x7, 0x51}, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3414.438429][ T6527] kobject: 'tx-0' (00000000acab8018): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3414.462031][ T6527] kobject: 'tx-0' (00000000acab8018): kobject_uevent_env
[ 3414.478511][ T6527] kobject: 'tx-0' (00000000acab8018): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3414.495316][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3414.503480][ T6527] kobject: 'batman_adv' (00000000f543f8be): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3414.514082][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3414.526032][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3414.538430][ T6528] kobject: 'tx-1' (000000007f9d91ed): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3414.548724][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3414.559276][ T6528] kobject: 'tx-1' (000000007f9d91ed): kobject_uevent_env
[ 3414.575236][ T6528] kobject: 'tx-1' (000000007f9d91ed): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3414.599657][ T6528] kobject: 'rx-1' (00000000a3a5bde3): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3414.616596][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3414.622019][ T6528] kobject: 'rx-1' (00000000a3a5bde3): kobject_uevent_env
[ 3414.623855][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3414.631327][ T6528] kobject: 'rx-1' (00000000a3a5bde3): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3414.658381][ T6526] kobject: 'tx-1' (000000007f9d91ed): kobject_cleanup, parent 000000002ad19ca6
[ 3414.679673][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3414.684901][ T6526] kobject: 'tx-1' (000000007f9d91ed): auto cleanup 'remove' event
[ 3414.686871][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3414.697498][ T6526] kobject: 'tx-1' (000000007f9d91ed): kobject_uevent_env
[ 3414.715969][ T6526] kobject: 'tx-1' (000000007f9d91ed): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3414.727605][ T6526] kobject: 'tx-1' (000000007f9d91ed): auto cleanup kobject_del
[ 3414.738459][ T6526] kobject: 'tx-1' (000000007f9d91ed): calling ktype release
[ 3414.746289][ T6526] kobject: 'tx-1': free name
[ 3414.754360][ T6526] kobject: 'rx-1' (00000000a3a5bde3): kobject_cleanup, parent 000000002ad19ca6
[ 3414.764394][ T6526] kobject: 'rx-1' (00000000a3a5bde3): auto cleanup 'remove' event
[ 3414.775328][ T6526] kobject: 'rx-1' (00000000a3a5bde3): kobject_uevent_env
[ 3414.782830][ T6526] kobject: 'rx-1' (00000000a3a5bde3): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3414.796880][ T6526] kobject: 'rx-1' (00000000a3a5bde3): auto cleanup kobject_del
[ 3414.804969][ T6526] kobject: 'rx-1' (00000000a3a5bde3): calling ktype release
[ 3414.815781][ T6526] kobject: 'rx-1': free name
[ 3414.822197][ T6526] kobject: 'batman_adv' (00000000f543f8be): kobject_uevent_env
[ 3414.832895][ T6526] kobject: 'batman_adv' (00000000f543f8be): kobject_uevent_env: filter function caused the event to drop!
[ 3414.856285][ T6526] kobject: 'batman_adv' (00000000f543f8be): kobject_cleanup, parent 00000000e9cdb645
[ 3414.866531][ T6526] kobject: 'batman_adv' (00000000f543f8be): calling ktype release
[ 3414.877398][ T6526] kobject: (00000000f543f8be): dynamic_kobj_release
[ 3414.884588][ T6526] kobject: 'batman_adv': free name
[ 3414.892970][ T6526] kobject: 'rx-0' (00000000948eaa64): kobject_cleanup, parent 000000002ad19ca6
[ 3414.902563][ T6526] kobject: 'rx-0' (00000000948eaa64): auto cleanup 'remove' event
[ 3414.913507][ T6526] kobject: 'rx-0' (00000000948eaa64): kobject_uevent_env
[ 3414.921056][ T6526] kobject: 'rx-0' (00000000948eaa64): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3414.935064][ T6526] kobject: 'rx-0' (00000000948eaa64): auto cleanup kobject_del
[ 3414.943529][ T6526] kobject: 'rx-0' (00000000948eaa64): calling ktype release
[ 3414.953906][ T6526] kobject: 'rx-0': free name
[ 3414.958965][ T6526] kobject: 'tx-0' (00000000acab8018): kobject_cleanup, parent 000000002ad19ca6
[ 3414.968012][ T6526] kobject: 'tx-0' (00000000acab8018): auto cleanup 'remove' event
[ 3414.979096][ T6526] kobject: 'tx-0' (00000000acab8018): kobject_uevent_env
[ 3414.986327][ T6526] kobject: 'tx-0' (00000000acab8018): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3415.002906][ T6526] kobject: 'tx-0' (00000000acab8018): auto cleanup kobject_del
[ 3415.010996][ T6526] kobject: 'tx-0' (00000000acab8018): calling ktype release
[ 3415.018408][ T6526] kobject: 'tx-0': free name
[ 3415.026091][ T6526] kobject: 'queues' (000000002ad19ca6): kobject_cleanup, parent 00000000e9cdb645
[ 3415.047532][ T6526] kobject: 'queues' (000000002ad19ca6): calling ktype release
[ 3415.055576][ T6526] kobject: 'queues' (000000002ad19ca6): kset_release
[ 3415.065365][ T6526] kobject: 'queues': free name
[ 3415.071451][ T6526] kobject: 'nr0
' (000000005620f780): kobject_uevent_env
[ 3415.081629][ T6526] kobject: 'nr0
' (000000005620f780): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:03 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:03 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:03 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380))
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in6=@mcast1}}, {{@in=@remote}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8)

10:13:03 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:03 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
rmdir(&(0x7f0000000000)='./file0\x00')
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:03 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3415.128844][ T6526] kobject: 'nr0
' (000000005620f780): kobject_cleanup, parent 00000000e9cdb645
[ 3415.137932][ T6526] kobject: 'nr0
' (000000005620f780): calling ktype release
[ 3415.148281][ T6526] kobject: 'nr0
': free name
10:13:04 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:04 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3415.228476][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3415.261828][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
10:13:04 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000180)=0xc)
getresuid(&(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380))

10:13:04 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x80000)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8)
ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000000240)={@rand_addr="b65eaabacc5e0abb0b99163d0710a0d5", @rand_addr="fa603a0560f806c41ed885e7a8e0c943", @empty, 0x40, 0x3, 0x0, 0x0, 0x7, 0x0, r2})

[ 3415.279346][ T6561] kobject: 'nr0
' (000000005fb2dd7d): kobject_add_internal: parent: 'net', set: 'devices'
[ 3415.296514][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3415.319550][ T6561] kobject: 'nr0
' (000000005fb2dd7d): kobject_uevent_env
10:13:04 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:04 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3415.328053][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3415.338549][ T6561] kobject: 'nr0
' (000000005fb2dd7d): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3415.351046][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3415.358588][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3415.372061][ T6561] kobject: 'queues' (00000000ee753951): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3415.384590][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3415.394584][ T6561] kobject: 'queues' (00000000ee753951): kobject_uevent_env
[ 3415.401957][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3415.415664][ T6561] kobject: 'queues' (00000000ee753951): kobject_uevent_env: filter function caused the event to drop!
[ 3415.434978][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3415.442437][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3415.455106][ T6561] kobject: 'rx-0' (00000000ca198ef5): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3415.478727][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3415.481392][ T6561] kobject: 'rx-0' (00000000ca198ef5): kobject_uevent_env
[ 3415.485962][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3415.487434][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3415.496591][ T6561] kobject: 'rx-0' (00000000ca198ef5): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3415.503420][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3415.513512][ T6561] kobject: 'tx-0' (000000007459f337): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3415.558419][ T6561] kobject: 'tx-0' (000000007459f337): kobject_uevent_env
[ 3415.576296][ T6561] kobject: 'tx-0' (000000007459f337): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3415.576841][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3415.592453][ T6561] kobject: 'batman_adv' (00000000f9ddc557): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3415.594544][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3415.605986][ T6568] kobject: 'tx-1' (00000000ea6e5e03): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3415.632634][ T6568] kobject: 'tx-1' (00000000ea6e5e03): kobject_uevent_env
[ 3415.641741][ T6568] kobject: 'tx-1' (00000000ea6e5e03): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3415.654601][ T6568] kobject: 'rx-1' (0000000072066f22): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3415.666766][ T6568] kobject: 'rx-1' (0000000072066f22): kobject_uevent_env
[ 3415.676597][ T6568] kobject: 'rx-1' (0000000072066f22): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3415.690829][ T6580] validate_nla: 12 callbacks suppressed
[ 3415.690839][ T6580] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3415.704816][ T6560] kobject: 'tx-1' (00000000ea6e5e03): kobject_cleanup, parent 00000000ee753951
[ 3415.725859][ T6560] kobject: 'tx-1' (00000000ea6e5e03): auto cleanup 'remove' event
[ 3415.733853][ T6560] kobject: 'tx-1' (00000000ea6e5e03): kobject_uevent_env
[ 3415.741026][ T6560] kobject: 'tx-1' (00000000ea6e5e03): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3415.752072][ T6560] kobject: 'tx-1' (00000000ea6e5e03): auto cleanup kobject_del
[ 3415.760017][ T6560] kobject: 'tx-1' (00000000ea6e5e03): calling ktype release
[ 3415.767415][ T6560] kobject: 'tx-1': free name
[ 3415.772364][ T6560] kobject: 'rx-1' (0000000072066f22): kobject_cleanup, parent 00000000ee753951
[ 3415.781603][ T6560] kobject: 'rx-1' (0000000072066f22): auto cleanup 'remove' event
[ 3415.789556][ T6560] kobject: 'rx-1' (0000000072066f22): kobject_uevent_env
[ 3415.796747][ T6560] kobject: 'rx-1' (0000000072066f22): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3415.807836][ T6560] kobject: 'rx-1' (0000000072066f22): auto cleanup kobject_del
[ 3415.815579][ T6560] kobject: 'rx-1' (0000000072066f22): calling ktype release
[ 3415.823018][ T6560] kobject: 'rx-1': free name
[ 3415.831408][ T6560] kobject: 'batman_adv' (00000000f9ddc557): kobject_uevent_env
[ 3415.839599][ T6560] kobject: 'batman_adv' (00000000f9ddc557): kobject_uevent_env: filter function caused the event to drop!
[ 3415.853202][ T6560] kobject: 'batman_adv' (00000000f9ddc557): kobject_cleanup, parent 00000000e9cdb645
[ 3415.863327][ T6560] kobject: 'batman_adv' (00000000f9ddc557): calling ktype release
[ 3415.873436][ T6560] kobject: (00000000f9ddc557): dynamic_kobj_release
[ 3415.880713][ T6560] kobject: 'batman_adv': free name
[ 3415.886229][ T6560] kobject: 'rx-0' (00000000ca198ef5): kobject_cleanup, parent 00000000ee753951
[ 3415.897473][ T6560] kobject: 'rx-0' (00000000ca198ef5): auto cleanup 'remove' event
[ 3415.905844][ T6560] kobject: 'rx-0' (00000000ca198ef5): kobject_uevent_env
[ 3415.915198][ T6560] kobject: 'rx-0' (00000000ca198ef5): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3415.926784][ T6560] kobject: 'rx-0' (00000000ca198ef5): auto cleanup kobject_del
[ 3415.936633][ T6560] kobject: 'rx-0' (00000000ca198ef5): calling ktype release
[ 3415.944489][ T6560] kobject: 'rx-0': free name
[ 3415.951453][ T6560] kobject: 'tx-0' (000000007459f337): kobject_cleanup, parent 00000000ee753951
[ 3415.960914][ T6560] kobject: 'tx-0' (000000007459f337): auto cleanup 'remove' event
[ 3415.970961][ T6560] kobject: 'tx-0' (000000007459f337): kobject_uevent_env
[ 3415.978158][ T6560] kobject: 'tx-0' (000000007459f337): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3415.991754][ T6560] kobject: 'tx-0' (000000007459f337): auto cleanup kobject_del
[ 3415.999444][ T6560] kobject: 'tx-0' (000000007459f337): calling ktype release
[ 3416.006857][ T6560] kobject: 'tx-0': free name
[ 3416.014150][ T6560] kobject: 'queues' (00000000ee753951): kobject_cleanup, parent 00000000e9cdb645
[ 3416.023426][ T6560] kobject: 'queues' (00000000ee753951): calling ktype release
[ 3416.033713][ T6560] kobject: 'queues' (00000000ee753951): kset_release
[ 3416.040579][ T6560] kobject: 'queues': free name
[ 3416.046352][ T6560] kobject: 'nr0
' (000000005fb2dd7d): kobject_uevent_env
[ 3416.056188][ T6560] kobject: 'nr0
' (000000005fb2dd7d): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:04 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:04 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000140), &(0x7f0000000180)=0xc)

10:13:04 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000000c0))
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x400000, 0x0)
write$FUSE_POLL(r1, &(0x7f00000002c0)={0x18, 0x0, 0x5, {0x200}}, 0x18)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xa)
prctl$PR_CAPBSET_READ(0x17, 0x10)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
ioctl$VHOST_GET_VRING_BASE(r1, 0xc008af12, &(0x7f0000000300))
r2 = syz_open_dev$dspn(&(0x7f0000000200)='/dev/dsp#\x00', 0x7f, 0x400001)
setsockopt$RXRPC_SECURITY_KEY(r2, 0x110, 0x1, &(0x7f0000000240)='\'dev/\xffsp#\x00', 0xfb0ef773df2b1007)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r3 = syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x2, 0x40000)
ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r3, 0xc040564a, &(0x7f0000000140)={0x8, 0x0, 0x0, 0x7, 0x0, 0x3, 0x200, 0x1})

10:13:04 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, 0x0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:04 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)

10:13:04 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3416.111524][ T6560] kobject: 'nr0
' (000000005fb2dd7d): kobject_cleanup, parent 00000000e9cdb645
[ 3416.120669][ T6560] kobject: 'nr0
' (000000005fb2dd7d): calling ktype release
[ 3416.128082][ T6560] kobject: 'nr0
': free name
[ 3416.189144][ T6585] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3416.202464][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3416.228873][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
10:13:05 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
setsockopt$inet_sctp_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000640)=0x7c8a2314, 0x4)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:05 executing program 4:
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:05 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000000)=0x40)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3416.240490][ T6593] kobject: 'nr0
' (00000000eaed8dba): kobject_add_internal: parent: 'net', set: 'devices'
[ 3416.261066][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3416.268158][ T6593] kobject: 'nr0
' (00000000eaed8dba): kobject_uevent_env
[ 3416.268343][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
10:13:05 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f0000000240), 0xfec)

[ 3416.289826][ T6593] kobject: 'nr0
' (00000000eaed8dba): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3416.325442][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3416.336243][ T6593] kobject: 'queues' (00000000d9ef2b4d): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3416.349900][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3416.354564][ T6593] kobject: 'queues' (00000000d9ef2b4d): kobject_uevent_env
[ 3416.373124][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3416.377089][ T6593] kobject: 'queues' (00000000d9ef2b4d): kobject_uevent_env: filter function caused the event to drop!
10:13:05 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:05 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
syz_open_dev$swradio(&(0x7f0000000600)='/dev/swradio#\x00', 0x1, 0x2)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3416.385597][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3416.404559][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3416.412133][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3416.475951][ T6593] kobject: 'rx-0' (00000000b6da9d1d): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3416.494474][ T6593] kobject: 'rx-0' (00000000b6da9d1d): kobject_uevent_env
[ 3416.497831][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3416.503488][ T6593] kobject: 'rx-0' (00000000b6da9d1d): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3416.510271][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3416.523037][ T6593] kobject: 'tx-0' (00000000b3e8508e): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3416.543041][ T6593] kobject: 'tx-0' (00000000b3e8508e): kobject_uevent_env
[ 3416.550640][ T6593] kobject: 'tx-0' (00000000b3e8508e): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3416.565631][ T6593] kobject: 'batman_adv' (0000000070b129b8): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3416.582771][ T6594] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3416.594236][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3416.602687][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3416.609053][ T6596] kobject: 'tx-1' (00000000667c59fb): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3416.623986][ T6596] kobject: 'tx-1' (00000000667c59fb): kobject_uevent_env
[ 3416.632109][ T6596] kobject: 'tx-1' (00000000667c59fb): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3416.653961][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3416.654370][ T6596] kobject: 'rx-1' (00000000b0faa668): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3416.661323][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3416.676127][ T6596] kobject: 'rx-1' (00000000b0faa668): kobject_uevent_env
[ 3416.689820][ T6596] kobject: 'rx-1' (00000000b0faa668): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3416.704059][ T6591] kobject: 'tx-1' (00000000667c59fb): kobject_cleanup, parent 00000000d9ef2b4d
[ 3416.713295][ T6591] kobject: 'tx-1' (00000000667c59fb): auto cleanup 'remove' event
[ 3416.721377][ T6591] kobject: 'tx-1' (00000000667c59fb): kobject_uevent_env
[ 3416.728522][ T6591] kobject: 'tx-1' (00000000667c59fb): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3416.739713][ T6591] kobject: 'tx-1' (00000000667c59fb): auto cleanup kobject_del
[ 3416.747406][ T6591] kobject: 'tx-1' (00000000667c59fb): calling ktype release
[ 3416.755230][ T6591] kobject: 'tx-1': free name
[ 3416.760237][ T6591] kobject: 'rx-1' (00000000b0faa668): kobject_cleanup, parent 00000000d9ef2b4d
[ 3416.769400][ T6591] kobject: 'rx-1' (00000000b0faa668): auto cleanup 'remove' event
[ 3416.777317][ T6591] kobject: 'rx-1' (00000000b0faa668): kobject_uevent_env
[ 3416.784662][ T6591] kobject: 'rx-1' (00000000b0faa668): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3416.795825][ T6591] kobject: 'rx-1' (00000000b0faa668): auto cleanup kobject_del
[ 3416.803638][ T6591] kobject: 'rx-1' (00000000b0faa668): calling ktype release
[ 3416.811181][ T6591] kobject: 'rx-1': free name
[ 3416.817358][ T6591] kobject: 'batman_adv' (0000000070b129b8): kobject_uevent_env
[ 3416.825607][ T6591] kobject: 'batman_adv' (0000000070b129b8): kobject_uevent_env: filter function caused the event to drop!
[ 3416.837190][ T6591] kobject: 'batman_adv' (0000000070b129b8): kobject_cleanup, parent 00000000e9cdb645
[ 3416.846907][ T6591] kobject: 'batman_adv' (0000000070b129b8): calling ktype release
[ 3416.854920][ T6591] kobject: (0000000070b129b8): dynamic_kobj_release
[ 3416.861888][ T6591] kobject: 'batman_adv': free name
[ 3416.867339][ T6591] kobject: 'rx-0' (00000000b6da9d1d): kobject_cleanup, parent 00000000d9ef2b4d
[ 3416.876556][ T6591] kobject: 'rx-0' (00000000b6da9d1d): auto cleanup 'remove' event
[ 3416.884595][ T6591] kobject: 'rx-0' (00000000b6da9d1d): kobject_uevent_env
[ 3416.891875][ T6591] kobject: 'rx-0' (00000000b6da9d1d): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3416.903078][ T6591] kobject: 'rx-0' (00000000b6da9d1d): auto cleanup kobject_del
[ 3416.911177][ T6591] kobject: 'rx-0' (00000000b6da9d1d): calling ktype release
[ 3416.918556][ T6591] kobject: 'rx-0': free name
[ 3416.923441][ T6591] kobject: 'tx-0' (00000000b3e8508e): kobject_cleanup, parent 00000000d9ef2b4d
[ 3416.932809][ T6591] kobject: 'tx-0' (00000000b3e8508e): auto cleanup 'remove' event
[ 3416.940894][ T6591] kobject: 'tx-0' (00000000b3e8508e): kobject_uevent_env
[ 3416.948079][ T6591] kobject: 'tx-0' (00000000b3e8508e): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3416.959264][ T6591] kobject: 'tx-0' (00000000b3e8508e): auto cleanup kobject_del
[ 3416.966970][ T6591] kobject: 'tx-0' (00000000b3e8508e): calling ktype release
[ 3416.974508][ T6591] kobject: 'tx-0': free name
[ 3416.979299][ T6591] kobject: 'queues' (00000000d9ef2b4d): kobject_cleanup, parent 00000000e9cdb645
[ 3416.988550][ T6591] kobject: 'queues' (00000000d9ef2b4d): calling ktype release
[ 3416.996328][ T6591] kobject: 'queues' (00000000d9ef2b4d): kset_release
[ 3417.004719][ T6591] kobject: 'queues': free name
[ 3417.009989][ T6591] kobject: 'nr0
' (00000000eaed8dba): kobject_uevent_env
[ 3417.017144][ T6591] kobject: 'nr0
' (00000000eaed8dba): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:05 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:05 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))
sendfile(r0, r0, &(0x7f0000000040), 0x7f)

10:13:05 executing program 2:
r0 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x0, 0x2)
openat$cgroup_ro(r0, &(0x7f0000000100)='cgroup.events\x00', 0x0, 0x0)
r1 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r1, &(0x7f0000000000)='/', 0x124)
sendfile(r1, r1, &(0x7f0000000040), 0x7f)
sendfile(r1, r1, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r1, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:05 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:05 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3417.098829][ T6591] kobject: 'nr0
' (00000000eaed8dba): kobject_cleanup, parent 00000000e9cdb645
[ 3417.107924][ T6591] kobject: 'nr0
' (00000000eaed8dba): calling ktype release
[ 3417.118727][ T6591] kobject: 'nr0
': free name
10:13:05 executing program 4:
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3417.170300][ T6724] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3417.193604][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3417.205453][ T6728] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
10:13:06 executing program 4:
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:06 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f0000000000)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x800000805010, 0x0)

10:13:06 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3417.219838][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
[ 3417.232123][ T6729] kobject: 'nr0
' (00000000ecf32405): kobject_add_internal: parent: 'net', set: 'devices'
[ 3417.240566][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
10:13:06 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:06 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_setup(0x7, &(0x7f0000000000)=<r1=>0x0)
io_cancel(r1, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3417.260847][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3417.272071][ T6729] kobject: 'nr0
' (00000000ecf32405): kobject_uevent_env
[ 3417.289345][ T6729] kobject: 'nr0
' (00000000ecf32405): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3417.309399][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
10:13:06 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3417.316827][ T6729] kobject: 'queues' (00000000d40c7cdf): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3417.330009][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3417.342328][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3417.351339][ T6729] kobject: 'queues' (00000000d40c7cdf): kobject_uevent_env
[ 3417.359875][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3417.371407][ T6729] kobject: 'queues' (00000000d40c7cdf): kobject_uevent_env: filter function caused the event to drop!
[ 3417.385234][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3417.391551][ T6729] kobject: 'rx-0' (00000000c78dbbfb): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3417.392566][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3417.422884][ T6729] kobject: 'rx-0' (00000000c78dbbfb): kobject_uevent_env
[ 3417.456689][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3417.457682][ T6729] kobject: 'rx-0' (00000000c78dbbfb): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3417.465211][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3417.478160][ T6729] kobject: 'tx-0' (0000000066cfc866): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3417.493549][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3417.498607][ T6729] kobject: 'tx-0' (0000000066cfc866): kobject_uevent_env
[ 3417.503119][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3417.509775][ T6729] kobject: 'tx-0' (0000000066cfc866): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3417.534611][ T6729] kobject: 'batman_adv' (0000000000d14d57): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3417.545786][ T6731] kobject: 'tx-1' (00000000142f5ef9): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3417.559729][ T6731] kobject: 'tx-1' (00000000142f5ef9): kobject_uevent_env
[ 3417.572165][ T6731] kobject: 'tx-1' (00000000142f5ef9): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3417.584446][ T6731] kobject: 'rx-1' (000000006426fde7): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3417.596772][ T6731] kobject: 'rx-1' (000000006426fde7): kobject_uevent_env
[ 3417.604919][ T6731] kobject: 'rx-1' (000000006426fde7): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3417.618125][ T6739] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3417.626713][ T6727] kobject: 'tx-1' (00000000142f5ef9): kobject_cleanup, parent 00000000d40c7cdf
[ 3417.636097][ T6727] kobject: 'tx-1' (00000000142f5ef9): auto cleanup 'remove' event
[ 3417.648699][ T6727] kobject: 'tx-1' (00000000142f5ef9): kobject_uevent_env
[ 3417.655774][ T6727] kobject: 'tx-1' (00000000142f5ef9): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3417.667037][ T6727] kobject: 'tx-1' (00000000142f5ef9): auto cleanup kobject_del
[ 3417.674210][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3417.674997][ T6727] kobject: 'tx-1' (00000000142f5ef9): calling ktype release
[ 3417.684136][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3417.689470][ T6727] kobject: 'tx-1': free name
[ 3417.704866][ T6727] kobject: 'rx-1' (000000006426fde7): kobject_cleanup, parent 00000000d40c7cdf
[ 3417.714136][ T6727] kobject: 'rx-1' (000000006426fde7): auto cleanup 'remove' event
[ 3417.722330][ T6727] kobject: 'rx-1' (000000006426fde7): kobject_uevent_env
[ 3417.729664][ T6727] kobject: 'rx-1' (000000006426fde7): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3417.740948][ T6727] kobject: 'rx-1' (000000006426fde7): auto cleanup kobject_del
[ 3417.748549][ T6727] kobject: 'rx-1' (000000006426fde7): calling ktype release
[ 3417.756185][ T6727] kobject: 'rx-1': free name
[ 3417.761073][ T6846] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3417.770682][ T6727] kobject: 'batman_adv' (0000000000d14d57): kobject_uevent_env
[ 3417.778259][ T6727] kobject: 'batman_adv' (0000000000d14d57): kobject_uevent_env: filter function caused the event to drop!
[ 3417.801477][ T6727] kobject: 'batman_adv' (0000000000d14d57): kobject_cleanup, parent 00000000e9cdb645
[ 3417.811315][ T6727] kobject: 'batman_adv' (0000000000d14d57): calling ktype release
[ 3417.819559][ T6727] kobject: (0000000000d14d57): dynamic_kobj_release
[ 3417.826166][ T6727] kobject: 'batman_adv': free name
[ 3417.832038][ T6727] kobject: 'rx-0' (00000000c78dbbfb): kobject_cleanup, parent 00000000d40c7cdf
[ 3417.841309][ T6727] kobject: 'rx-0' (00000000c78dbbfb): auto cleanup 'remove' event
[ 3417.849396][ T6727] kobject: 'rx-0' (00000000c78dbbfb): kobject_uevent_env
[ 3417.856462][ T6727] kobject: 'rx-0' (00000000c78dbbfb): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3417.867776][ T6727] kobject: 'rx-0' (00000000c78dbbfb): auto cleanup kobject_del
[ 3417.875738][ T6727] kobject: 'rx-0' (00000000c78dbbfb): calling ktype release
[ 3417.883355][ T6727] kobject: 'rx-0': free name
[ 3417.888012][ T6727] kobject: 'tx-0' (0000000066cfc866): kobject_cleanup, parent 00000000d40c7cdf
[ 3417.897313][ T6727] kobject: 'tx-0' (0000000066cfc866): auto cleanup 'remove' event
[ 3417.905418][ T6727] kobject: 'tx-0' (0000000066cfc866): kobject_uevent_env
[ 3417.912848][ T6727] kobject: 'tx-0' (0000000066cfc866): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3417.924157][ T6727] kobject: 'tx-0' (0000000066cfc866): auto cleanup kobject_del
[ 3417.932089][ T6727] kobject: 'tx-0' (0000000066cfc866): calling ktype release
[ 3417.939665][ T6727] kobject: 'tx-0': free name
[ 3417.944302][ T6727] kobject: 'queues' (00000000d40c7cdf): kobject_cleanup, parent 00000000e9cdb645
[ 3417.953756][ T6727] kobject: 'queues' (00000000d40c7cdf): calling ktype release
[ 3417.961595][ T6727] kobject: 'queues' (00000000d40c7cdf): kset_release
[ 3417.968290][ T6727] kobject: 'queues': free name
[ 3417.973815][ T6727] kobject: 'nr0
' (00000000ecf32405): kobject_uevent_env
[ 3417.981207][ T6727] kobject: 'nr0
' (00000000ecf32405): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:06 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:06 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:06 executing program 2:
r0 = memfd_create(&(0x7f00000000c0)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000000400)='/', 0x1)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/expire_nodest_conn\x00', 0x2, 0x0)
ioctl$sock_bt_hci(r1, 0xc00448ff, &(0x7f0000000300)="f743446c0e34a00804b0ad975c7bef1cf6b9323242d9444ce1d86afe6643ec2ad473a9ba49364b338f36215a53ce18e9ad4d76ebbdb9473b6573215f7f3630fb2b50d3cca415bbce2279bb0865509075438bb6f02eb1a1e9ae610b5fc49dd6f3e9f491af1412fd75d3ef6bf6f38226e4bed8a987f2e055277625dc4a5f98458dad70dec056d9001055686a54138378aaaa7fbd45fdd901bbc9c9c0d80c2ce247f1547a2df07890c9885c0016f96167d44f88c753cc0b117b3c713c55512205ba5474ec3258a5df4afbca28d34131d8105542899c")
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r2 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x4000)
setsockopt$RDS_GET_MR(r2, 0x114, 0x2, &(0x7f0000000140)={{&(0x7f0000000200)=""/231, 0xe7}, &(0x7f0000000100), 0x3}, 0x20)
mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x7, 0x10, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:06 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_cancel(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

10:13:06 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:06 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3418.028872][ T6727] kobject: 'nr0
' (00000000ecf32405): kobject_cleanup, parent 00000000e9cdb645
[ 3418.037968][ T6727] kobject: 'nr0
' (00000000ecf32405): calling ktype release
[ 3418.049361][ T6727] kobject: 'nr0
': free name
10:13:06 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_cancel(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3418.118293][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3418.131473][ T6854] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3418.139075][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
[ 3418.160221][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
10:13:06 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3418.173172][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3418.186130][ T6871] kobject: 'nr0
' (00000000dfe082fd): kobject_add_internal: parent: 'net', set: 'devices'
[ 3418.203349][ T6871] kobject: 'nr0
' (00000000dfe082fd): kobject_uevent_env
10:13:07 executing program 4:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(0x0)
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:07 executing program 3:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
io_cancel(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, r0, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3418.230843][ T6871] kobject: 'nr0
' (00000000dfe082fd): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3418.248319][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3418.257500][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
10:13:07 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3418.272233][ T6871] kobject: 'queues' (0000000063944f04): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3418.297865][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
10:13:07 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0)
ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f00000000c0)={0x0, 0xfff, {0x51, 0x0, 0x4, {0x6, 0x8100000000}, {0x4, 0x20}, @ramp={0x4d9, 0x2, {0x1000, 0xfe8, 0x2, 0x439}}}, {0x0, 0x6, 0x5798, {0x2, 0x6a}, {0x4ca6a270, 0x10000}, @const={0x2, {0x2, 0xffffffffffff0001, 0x6}}}})
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

[ 3418.329022][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3418.337065][ T6871] kobject: 'queues' (0000000063944f04): kobject_uevent_env
[ 3418.341543][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3418.354668][ T6871] kobject: 'queues' (0000000063944f04): kobject_uevent_env: filter function caused the event to drop!
[ 3418.360769][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3418.381770][ T6871] kobject: 'rx-0' (000000005e463f93): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3418.391388][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3418.395846][ T6871] kobject: 'rx-0' (000000005e463f93): kobject_uevent_env
[ 3418.409157][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3418.414540][ T6871] kobject: 'rx-0' (000000005e463f93): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3418.448846][ T6871] kobject: 'tx-0' (00000000cdb8d1b6): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3418.467473][ T6871] kobject: 'tx-0' (00000000cdb8d1b6): kobject_uevent_env
[ 3418.488063][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3418.488311][ T6871] kobject: 'tx-0' (00000000cdb8d1b6): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3418.495800][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3418.510722][ T6871] kobject: 'batman_adv' (00000000de446621): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3418.529940][ T6895] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3418.538121][ T6967] kobject: 'tx-1' (000000005cfa2d90): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3418.571563][ T6967] kobject: 'tx-1' (000000005cfa2d90): kobject_uevent_env
[ 3418.587372][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3418.587965][ T6967] kobject: 'tx-1' (000000005cfa2d90): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3418.595014][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3418.606059][ T6967] kobject: 'rx-1' (0000000039357311): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3418.626464][ T6967] kobject: 'rx-1' (0000000039357311): kobject_uevent_env
[ 3418.633953][ T6967] kobject: 'rx-1' (0000000039357311): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3418.647613][ T6870] kobject: 'tx-1' (000000005cfa2d90): kobject_cleanup, parent 0000000063944f04
[ 3418.656796][ T6870] kobject: 'tx-1' (000000005cfa2d90): auto cleanup 'remove' event
[ 3418.664742][ T6870] kobject: 'tx-1' (000000005cfa2d90): kobject_uevent_env
[ 3418.671963][ T6870] kobject: 'tx-1' (000000005cfa2d90): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3418.683058][ T6870] kobject: 'tx-1' (000000005cfa2d90): auto cleanup kobject_del
[ 3418.690914][ T6870] kobject: 'tx-1' (000000005cfa2d90): calling ktype release
[ 3418.698276][ T6870] kobject: 'tx-1': free name
[ 3418.704308][ T6870] kobject: 'rx-1' (0000000039357311): kobject_cleanup, parent 0000000063944f04
[ 3418.716021][ T6870] kobject: 'rx-1' (0000000039357311): auto cleanup 'remove' event
[ 3418.724328][ T6870] kobject: 'rx-1' (0000000039357311): kobject_uevent_env
[ 3418.734663][ T6870] kobject: 'rx-1' (0000000039357311): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3418.746102][ T6870] kobject: 'rx-1' (0000000039357311): auto cleanup kobject_del
[ 3418.756726][ T6870] kobject: 'rx-1' (0000000039357311): calling ktype release
[ 3418.764443][ T6870] kobject: 'rx-1': free name
[ 3418.773419][ T6870] kobject: 'batman_adv' (00000000de446621): kobject_uevent_env
[ 3418.781431][ T6870] kobject: 'batman_adv' (00000000de446621): kobject_uevent_env: filter function caused the event to drop!
[ 3418.795901][ T6870] kobject: 'batman_adv' (00000000de446621): kobject_cleanup, parent 00000000e9cdb645
[ 3418.805808][ T6870] kobject: 'batman_adv' (00000000de446621): calling ktype release
[ 3418.817141][ T6870] kobject: (00000000de446621): dynamic_kobj_release
[ 3418.824206][ T6870] kobject: 'batman_adv': free name
[ 3418.840149][ T6870] kobject: 'rx-0' (000000005e463f93): kobject_cleanup, parent 0000000063944f04
[ 3418.851997][ T6870] kobject: 'rx-0' (000000005e463f93): auto cleanup 'remove' event
[ 3418.860265][ T6870] kobject: 'rx-0' (000000005e463f93): kobject_uevent_env
[ 3418.867462][ T6870] kobject: 'rx-0' (000000005e463f93): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3418.881799][ T6870] kobject: 'rx-0' (000000005e463f93): auto cleanup kobject_del
[ 3418.889824][ T6870] kobject: 'rx-0' (000000005e463f93): calling ktype release
[ 3418.897215][ T6870] kobject: 'rx-0': free name
[ 3418.904997][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): kobject_cleanup, parent 0000000063944f04
[ 3418.914959][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): auto cleanup 'remove' event
[ 3418.925915][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): kobject_uevent_env
[ 3418.933460][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3418.947566][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): auto cleanup kobject_del
[ 3418.955651][ T6870] kobject: 'tx-0' (00000000cdb8d1b6): calling ktype release
[ 3418.966070][ T6870] kobject: 'tx-0': free name
[ 3418.971024][ T6870] kobject: 'queues' (0000000063944f04): kobject_cleanup, parent 00000000e9cdb645
[ 3418.983159][ T6870] kobject: 'queues' (0000000063944f04): calling ktype release
[ 3418.991050][ T6870] kobject: 'queues' (0000000063944f04): kset_release
[ 3418.997839][ T6870] kobject: 'queues': free name
[ 3419.007090][ T6870] kobject: 'nr0
' (00000000dfe082fd): kobject_uevent_env
[ 3419.014614][ T6870] kobject: 'nr0
' (00000000dfe082fd): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:07 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&')
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:07 executing program 3:
io_setup(0x7, &(0x7f0000000000)=<r0=>0x0)
io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

10:13:07 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:07 executing program 2:
r0 = memfd_create(&(0x7f0000001fc1)='/dev/audio\x00', 0x6)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='cpu.stat\x00', 0x0, 0x0)
ioctl$KDENABIO(r1, 0x4b36)
utimes(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)={{0x0, 0x2710}})
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x400000, 0x0)
ioctl$UDMABUF_CREATE(r2, 0x40187542, &(0x7f0000000140)={r0, 0x1, 0xfffffffffffff000, 0x4000})
setrlimit(0xf, &(0x7f0000000180)={0x10001, 0x7fffffff})
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00')
sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4880828a}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xec, r3, 0xa11, 0x70bd2a, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100000000}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1d}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e20}, @IPVS_DEST_ATTR_TUN_PORT={0x8, 0xe, 0x4e21}, @IPVS_DEST_ATTR_TUN_TYPE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0x14}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7f}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x2c}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0xec}, 0x1, 0x0, 0x0, 0x90}, 0x40000)

10:13:07 executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r1, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:07 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

[ 3419.058860][ T6870] kobject: 'nr0
' (00000000dfe082fd): kobject_cleanup, parent 00000000e9cdb645
[ 3419.067858][ T6870] kobject: 'nr0
' (00000000dfe082fd): calling ktype release
[ 3419.075700][ T6870] kobject: 'nr0
': free name
[ 3419.133720][ T7088] netlink: 'syz-executor.1': attribute type 2 has an invalid length.
[ 3419.145253][ T3881] kobject: 'loop5' (00000000097796eb): kobject_uevent_env
[ 3419.162613][ T3881] kobject: 'loop5' (00000000097796eb): fill_kobj_path: path = '/devices/virtual/block/loop5'
10:13:07 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f0000000040), 0x7f)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:07 executing program 4:
socket$nl_generic(0x10, 0x3, 0x10)
r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0)='TIPCv2\x00')
sendmsg$TIPC_NL_PEER_REMOVE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x20, r0, 0x1, 0x0, 0x0, {0xf}, [@TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x6}]}]}, 0x20}}, 0x0)

10:13:08 executing program 3:
io_setup(0x0, &(0x7f0000000000)=<r0=>0x0)
io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3419.174884][ T7091] kobject: 'nr0
' (00000000077f712e): kobject_add_internal: parent: 'net', set: 'devices'
[ 3419.195647][ T7091] kobject: 'nr0
' (00000000077f712e): kobject_uevent_env
[ 3419.210908][ T7091] kobject: 'nr0
' (00000000077f712e): fill_kobj_path: path = '/devices/virtual/net/nr0
'
[ 3419.219879][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
10:13:08 executing program 3:
io_setup(0x0, &(0x7f0000000000)=<r0=>0x0)
io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3419.229368][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3419.241860][ T7091] kobject: 'queues' (000000005a24fbb4): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3419.243601][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3419.260147][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3419.267051][ T7091] kobject: 'queues' (000000005a24fbb4): kobject_uevent_env
10:13:08 executing program 0:
r0 = memfd_create(&(0x7f0000001fc1)='\x00\xac=\x9d\xd2\xdb\xe6\xbf\xb4\b\xedcJ\x8e\x84\xd4N\x12\x9b\x1f\t\xbd\x11+\x86T\x16\xa3\xb3\xae0\x9f9?\xefo\xa4k\x012>\xa1\x9c\x86x\x1c\x9f\x84\x195\xde\x97_\t~\xf3Y\x12\"p^\xc1\x0f', 0x0)
write(r0, &(0x7f0000002000)='/', 0x1)
sendfile(r0, r0, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0)
mount(&(0x7f00000005c0)=ANY=[], &(0x7f0000000080)='.', 0x0, 0x5010, 0x0)

10:13:08 executing program 3:
io_setup(0x0, &(0x7f0000000000)=<r0=>0x0)
io_cancel(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

[ 3419.280242][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3419.281606][ T7091] kobject: 'queues' (000000005a24fbb4): kobject_uevent_env: filter function caused the event to drop!
[ 3419.296548][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3419.322079][ T7091] kobject: 'rx-0' (00000000c6235441): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3419.367023][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3419.373498][ T7091] kobject: 'rx-0' (00000000c6235441): kobject_uevent_env
[ 3419.374400][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3419.409705][ T7091] kobject: 'rx-0' (00000000c6235441): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3419.421512][ T7091] kobject: 'tx-0' (000000003ff81016): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3419.428194][ T3881] kobject: 'loop3' (00000000a094bf8c): kobject_uevent_env
[ 3419.433311][ T7091] kobject: 'tx-0' (000000003ff81016): kobject_uevent_env
[ 3419.446349][ T7091] kobject: 'tx-0' (000000003ff81016): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3419.450528][ T3881] kobject: 'loop3' (00000000a094bf8c): fill_kobj_path: path = '/devices/virtual/block/loop3'
[ 3419.458314][ T7091] kobject: 'batman_adv' (00000000f3a7c66d): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
[ 3419.491693][ T7095] kobject: 'tx-1' (00000000816ac79d): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3419.522570][ T7095] kobject: 'tx-1' (00000000816ac79d): kobject_uevent_env
[ 3419.529490][ T3881] kobject: 'loop2' (000000001e5f88eb): kobject_uevent_env
[ 3419.536961][ T3881] kobject: 'loop2' (000000001e5f88eb): fill_kobj_path: path = '/devices/virtual/block/loop2'
[ 3419.537367][ T7095] kobject: 'tx-1' (00000000816ac79d): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3419.559942][ T3881] kobject: 'loop4' (00000000c020021a): kobject_uevent_env
[ 3419.560752][ T7095] kobject: 'rx-1' (000000004abf7524): kobject_add_internal: parent: 'queues', set: 'queues'
[ 3419.567115][ T3881] kobject: 'loop4' (00000000c020021a): fill_kobj_path: path = '/devices/virtual/block/loop4'
[ 3419.608816][ T7095] kobject: 'rx-1' (000000004abf7524): kobject_uevent_env
[ 3419.615930][ T7095] kobject: 'rx-1' (000000004abf7524): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3419.645821][ T7090] kobject: 'tx-1' (00000000816ac79d): kobject_cleanup, parent 000000005a24fbb4
[ 3419.671709][ T7090] kobject: 'tx-1' (00000000816ac79d): auto cleanup 'remove' event
[ 3419.686276][ T7090] kobject: 'tx-1' (00000000816ac79d): kobject_uevent_env
[ 3419.697036][ T7090] kobject: 'tx-1' (00000000816ac79d): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
[ 3419.711650][ T7090] kobject: 'tx-1' (00000000816ac79d): auto cleanup kobject_del
[ 3419.719432][ T7090] kobject: 'tx-1' (00000000816ac79d): calling ktype release
[ 3419.726827][ T7090] kobject: 'tx-1': free name
[ 3419.734619][ T7090] kobject: 'rx-1' (000000004abf7524): kobject_cleanup, parent 000000005a24fbb4
[ 3419.743745][ T7090] kobject: 'rx-1' (000000004abf7524): auto cleanup 'remove' event
[ 3419.754611][ T7090] kobject: 'rx-1' (000000004abf7524): kobject_uevent_env
[ 3419.761823][ T7090] kobject: 'rx-1' (000000004abf7524): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
[ 3419.775570][ T7090] kobject: 'rx-1' (000000004abf7524): auto cleanup kobject_del
[ 3419.783498][ T7090] kobject: 'rx-1' (000000004abf7524): calling ktype release
[ 3419.793540][ T7090] kobject: 'rx-1': free name
[ 3419.799577][ T7090] kobject: 'batman_adv' (00000000f3a7c66d): kobject_uevent_env
[ 3419.807259][ T7090] kobject: 'batman_adv' (00000000f3a7c66d): kobject_uevent_env: filter function caused the event to drop!
[ 3419.821256][ T7090] kobject: 'batman_adv' (00000000f3a7c66d): kobject_cleanup, parent 00000000e9cdb645
[ 3419.830883][ T7090] kobject: 'batman_adv' (00000000f3a7c66d): calling ktype release
[ 3419.842004][ T7090] kobject: (00000000f3a7c66d): dynamic_kobj_release
[ 3419.848732][ T7090] kobject: 'batman_adv': free name
[ 3419.854187][ T7090] kobject: 'rx-0' (00000000c6235441): kobject_cleanup, parent 000000005a24fbb4
[ 3419.866261][ T7090] kobject: 'rx-0' (00000000c6235441): auto cleanup 'remove' event
[ 3419.877004][ T7090] kobject: 'rx-0' (00000000c6235441): kobject_uevent_env
[ 3419.886773][ T7090] kobject: 'rx-0' (00000000c6235441): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-0'
[ 3419.897918][ T7090] kobject: 'rx-0' (00000000c6235441): auto cleanup kobject_del
[ 3419.908310][ T7090] kobject: 'rx-0' (00000000c6235441): calling ktype release
[ 3419.915786][ T7090] kobject: 'rx-0': free name
[ 3419.923201][ T7090] kobject: 'tx-0' (000000003ff81016): kobject_cleanup, parent 000000005a24fbb4
[ 3419.932299][ T7090] kobject: 'tx-0' (000000003ff81016): auto cleanup 'remove' event
[ 3419.943061][ T7090] kobject: 'tx-0' (000000003ff81016): kobject_uevent_env
[ 3419.950788][ T7090] kobject: 'tx-0' (000000003ff81016): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
[ 3419.964430][ T7090] kobject: 'tx-0' (000000003ff81016): auto cleanup kobject_del
[ 3419.972192][ T7090] kobject: 'tx-0' (000000003ff81016): calling ktype release
[ 3419.982200][ T7090] kobject: 'tx-0': free name
[ 3419.986943][ T7090] kobject: 'queues' (000000005a24fbb4): kobject_cleanup, parent 00000000e9cdb645
[ 3419.996183][ T7090] kobject: 'queues' (000000005a24fbb4): calling ktype release
[ 3420.006380][ T7090] kobject: 'queues' (000000005a24fbb4): kset_release
[ 3420.013169][ T7090] kobject: 'queues': free name
[ 3420.018414][ T7090] kobject: 'nr0
' (00000000077f712e): kobject_uevent_env
[ 3420.028189][ T7090] kobject: 'nr0
' (00000000077f712e): fill_kobj_path: path = '/devices/virtual/net/nr0
'
10:13:08 executing program 5:
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000980)='./cgroup/syz0\x00', 0x200002, 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001a00)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x1132})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x400000001, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'nr0\x01\x00', 0x7132})
r2 = socket$kcm(0x29, 0x5, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000040)={[{0x3, '\x03\x8a\xa1t\x03n\xd7\xe0\x8f\x93\xdd\x86\xdd', 0x60}]}, 0x36)

10:13:08 executing program 3:
io_setup(0x7, 0x0)
io_cancel(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2, 0xfff, 0xffffffffffffffff, &(0x7f00000000c0)="cb383f34f5d89e6cf8927dfb3617d0daa90dae5f033ed3e61ba769fb34dec746fe6b15b70b00c1ff6c1474cd86ca5b9dd51604aaa6231d9c82f90d362821ab2a01017b49fd5783860f7aabc6c8439aaa295b0c1f7e3db1718aa98afc1aba54cf56125f19f56510a93051c017ef54aba17951ab709ad5eab7693304b7d06573f8551401c57022219acf705780e6b1402459ba60", 0x93, 0x9, 0x0, 0x2, 0xffffffffffffff9c}, &(0x7f0000000200))

10:13:08 executing program 2:
write(0xffffffffffffffff, &(0x7f0000002000)='/', 0x1)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040), 0x7f)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f00000001c0), 0xfec)
mmap(&(0x7f0000000000/0x30