fmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 570.305023][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 570.305040][ T28] audit: type=1804 audit(1704327939.953:1459): pid=13300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/168/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 [ 570.341371][ T28] audit: type=1804 audit(1704327939.953:1460): pid=13300 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/168/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 00:25:40 executing program 3: syz_emit_ethernet(0x3a, &(0x7f0000000700)={@local, @remote, @val={@val={0x88a8, 0x0, 0x1}}, {@ipv4={0x800, @dccp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x21, 0x0, @multicast2, @dev}, {{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 'q~{', 0x0, "f568c2"}}}}}}, 0x0) 00:25:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x600}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:40 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:40 executing program 3: sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, 0x0, 0x0) 00:25:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x700}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) [ 570.518208][ T28] audit: type=1804 audit(1704327940.163:1461): pid=13306 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/642/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 570.552450][T13307] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000e000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:40 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f00000069c0)=[{{&(0x7f0000004a40)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000004b80)=[{&(0x7f0000004a80)="3bab7ab59bfbe35f94749c09e0ae847f8fd2be4ea107e1661efe0d73f3a50069daf85fe7e1f016edf6b3e0aea0be450c89", 0x31}, {&(0x7f0000004ac0)="5b65ba426ef26991271e106bd94d7580a5c3d738203d874af65ef1341177cee25bdaddbfd2010613af7ef8363cbdaa6fee81d0b84a1c5cc5950a2659ebc98eeebc57b9990060c585d97a76", 0x4b}], 0x2}}, {{&(0x7f0000004bc0)={0xa, 0x4e20, 0x0, @private0}, 0x1c, 0x0, 0x0, &(0x7f0000004d40)=[@hoplimit={{0x14}}, @tclass={{0x14, 0x29, 0x43, 0x100}}], 0x30}}], 0x2, 0x20034844) [ 570.726798][ T28] audit: type=1804 audit(1704327940.373:1462): pid=13309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/302/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:25:40 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:40 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000004fc0)=[{{&(0x7f0000000100)={0x2, 0x4e21, 0x0, @mcast2}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000140)='K', 0x1}], 0x1}}], 0x1, 0xc814) [ 570.781758][T13315] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 570.796620][ T28] audit: type=1804 audit(1704327940.373:1463): pid=13309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/302/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:25:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a020f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 570.853943][ T28] audit: type=1804 audit(1704327940.443:1464): pid=13317 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/643/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 00:25:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xa00}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a030f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:40 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000009640)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @local}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f0000001480)=[{&(0x7f0000001440)="d8", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000001a40)=[{&(0x7f0000001640)="88", 0x1}], 0x1}}], 0x3, 0xc080) sendmmsg$inet6(r0, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 00:25:40 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 571.087885][ T28] audit: type=1804 audit(1704327940.733:1465): pid=13322 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/187/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 [ 571.152754][ T28] audit: type=1804 audit(1704327940.733:1466): pid=13322 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/187/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 [ 571.206658][ T28] audit: type=1804 audit(1704327940.843:1467): pid=13330 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/644/cgroup.controllers" dev="sda1" ino=1948 res=1 errno=0 00:25:41 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f00000000c0)=[{{&(0x7f0000000080)={0x2, 0x4e22, 0x0, @private1}, 0x1c, 0x0}}, {{&(0x7f0000000040)={0xa, 0x4e22, 0x0, @dev, 0x400}, 0x1c, 0x0}}], 0x2, 0x0) 00:25:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a040f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:41 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xc00}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xe00}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) [ 571.445911][ T28] audit: type=1804 audit(1704327941.093:1468): pid=13334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/169/cgroup.controllers" dev="sda1" ino=1953 res=1 errno=0 [ 571.585586][T13335] __nla_validate_parse: 213 callbacks suppressed [ 571.585607][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.653392][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.681829][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.703614][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.739940][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.756371][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.776442][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. 00:25:41 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000003b80)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0x0, @dev}, 0x1c, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="11000000000000002900000004"], 0x18}}], 0x1, 0x0) 00:25:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a050f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xf00}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:41 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 571.800487][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. 00:25:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a060f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 571.838986][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. [ 571.868732][T13335] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.0'. 00:25:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x2603}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:41 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c, 0x0, 0x0, &(0x7f0000000dc0)=[@pktinfo={{0x24, 0x29, 0x32, {@loopback}}}, @tclass={{0x14}}, @hopopts={{0x18}}, @dstopts_2292={{0x18}}], 0x70}}], 0x1, 0x0) 00:25:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x5865}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a070f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:42 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:42 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r0, 0x29, 0x43, &(0x7f00000000c0)=@routing, 0x4) 00:25:42 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x6000}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a080f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:42 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000009640)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @local={0xfe, 0xfc}}, 0x1c, 0x0}}], 0x1, 0x0) 00:25:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a090f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x6558}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:42 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000009640)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x0, @local}, 0x1c, 0x0, 0x0, &(0x7f0000001b00)=[@hopopts_2292={{0x18, 0x29, 0x3}}], 0x18}}], 0x1, 0x0) 00:25:42 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0a0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:42 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000000740)=[{{&(0x7f0000000200)={0xa, 0x4e21, 0x0, @mcast2, 0x4}, 0x1c, &(0x7f00000005c0)=[{&(0x7f0000000880)="817338e6c9c8bcbf970746c6364fb7744ba593f7f5110ae67410593e513cc56ff95caa4cee12e84e3cd715c45f4380297a833d2da79e9b61f26d1cd87bcf3b25c2da6aa61312c990245bf7302d9630a66166beb5fb2de69844b56b6b1993b2d6d5010ddbaf0398e0072cc0f8e8831c31b6adb5c92ae46c1ce522e851db49b82ab2d74e87fecca9f6750038bb7f8107359417505e2ca395bc79a6c848614fd4d9133c02e1e92723a335808300c589f5eafa0eb27c6d9c33ecfeab80fc918fcc0a71e7b98c186fafca4ce7b20d08cd34b6baf9abfd28e5553a7abe9d51d9d6aeec239b02aceb7ef1bfff3bbe978d3b45276db8facee161803a4aebd71e5a2dae9f561bfcc34cac8b3673b5c9f5817dccca4e64a99d8e549a315708bcb81f7415975d15fce0dcab531e945a600756a47d4a6a15058a1a9db94d0c1c2988f427b7d129a7c9cb957e7cdc09b5160bf16a31fa43b6f23c1911f65d03b55ba4adbd25137e53d04c762235b1abf5e3e79382f76666d525d72bd61ef2ea33b350803dc6247378d1e3cf18460e8a4a7935ba74744bc408c54589b2445cd3af7ca7ae49c61b5634f4e4b5a2a00afd32150353aa4ecc4a6a7238a5d5f8214855c9a987dab4e60d24e20430140bb30d81c64f7e5cb25a7f3cab0876d50376e455e10c1ef3c33c45b12df83bf4d17cfd0f6e3f4b3d590c6784a07eb85cdebf369504718f170c4295e7de685283644dfd8ffcabfdf7d16cd1b9d76b76808adca2bb5da96f254c3cf42bf8cf0ad0f75eab6b48901c25c03ba54ee3150f2846d5ec725b824a8b77a0fd90f591aceae34bcf8a01663bd75701e8760cfcd9027082b06eed6c7fcfd0b36e7c9dbb04d5d08e654a7c91f3653271b8114bc55d8009aac20433352359f2f0c3112213e914245ac900f71293006640a7b1a678816b79387ca622f505f69937252eafd857534268b7cbdfa93ddff0288215eaef119b3ae4bf699d2e97068024cd5845223c3eb5ff4d094eb22ca40c6a94c3ee0de99c30f0d5f6d3a29937866431cdc4a9d520cb78761d10618d2628585396105a9bd1b14b23c558cf8e20166c486a6689a5dc00133fb995cafb8402065047634c04867063f87e8b8d3aca0143538b46efda264bd7c454c86676a3dc06369f2921b4600b721c48bc2267ca12e4d7a7facf9400e74511aa09e9bd90b3e458f75ed7f32d242e36a7a95b93ea77ae1de53959a96438e4377a646eea4b991e18171a2b0f9f07289621029b0609fc9087b4f22771b19e9d05230b8adaa1a35d05c89b3cb0a2623177f388ec394ad290e8707c3bf7fe4783ed92b1146037f1ddee176bc8ea4db0461e126f8d6763f26f7c53616012464de5daa35031b18e6de7f9f32f71f85a30a0330159ceeff3c87fe365a6bd252fabba3b4f2c8e160d824b6df6124d5b197c9e28f3c4bfaa54427f8d487ac5fc3bdbaf7e38c9ab79ddec61d6baa30c5f9dfd486908631da5af6b0f2b334c936010397ee4bfce09e9ed24817fff94bcc5de9c302ca660e7593adf22b86498641686dd08818a87085fc1d679697825b32c72bf1eda151c9900c9d349cb3760b15b577a22bd3252a65365564968f450b0da3441db9f9523d39436878e4a11e625fc07fdb293deb21ec1c745a2de6aca014fb7878b1060a556165141a0edfb59482694ed31bc7859c3c4914cbb06f56d563e6780f8f2dbff31e330eb5f5a8bd36f9ebbdb15909aa463f39ad4aa80c719bfe01bf110ea0ed9748aa37f30f81b0719851db5f9a02b13eccf5633703089de27299e6827615d443184af45a7791dcf69a09e823369089d029f9b7cc59577388b6137209a181c6761b2fa01b9b91cdcdf4a149d4b51b7bb90c2b11affd21a40363090000f74b76167407051564e44a869dc9056134d3d07ee0d829233b8c8be3335c7d201ced95a1628752d1fe4cf01cb902c86ffd870e0181d02d024912f836438cbba73a048c08d7155a8aad5aee42bd6250b062f68fb9a77703dbd2e74339b8508791afa500019e9d3ac1d4ad93a5e0237fc9836194962e7ca3599984bd24c754bc224d865d4edae3b3f6aa03f4e17ba774cb8725649e97c7c4f047674b6e20fa5e372379335ab6cf02b5b5e72ee8a717fb9f633f598b3162d0184f99458b8bce74e2dec28174d37a2e61be1adc4d625712256ba1372a569758d33bfe4e6b9b751e5a046d9960465910af918f7d74ad2af1dfa3e694d18ef1fe1faade88dd53a7ab5d14cab86aa838b31fd6578d76565db4b3b5ea0467774c3bcbf4d61910483582f7f0611fdb2434f01207c328ebb6e1176503a9885d4f314d604d987dc61698e75ef083c8e85c88912fc57ddc2e374724a9f326e52aa7a95d628a9696aa909735537ac904f54d45792f521c6d849226311faa582595fdbc04d1595708d66d1c256d7ad53b34a2cba1301d1f9fd2da4f06e7f562a0b27520484a75ff0f0284bfc52eb4d962ade20040b99165d99b3ea0d577750e9b2f673b29209c629743e42f80bc957d84caf0557ceee7f52dc7e4ca9180ba546ecdcdf845dec114f03033da6691431ba4455d555d5e7be935484749367763bea3c899f3a3c8bc031b7b866c4bf070917ded7bc6e4fda15b40112f2f07455fc60985500b7fb618744a00004cd03ac99a3d2ca27ba6a35dc1ccb32a3058c9987a3149c4dc0149697b4beeff28eac8f6da1f937cff4ce9020b667267606d9c7a6c3cc5037e388e4169813f3747581be5794d5931bccec256c52d3473a6087a274b47f5cd6678b4bbee0f90e11f464e0d4009881d508df31e5963b1e9357c12f478e6bd14dfddea430545d35f95f630fc816b77c7dfaaf5a56431bc74e560282544930a14f5ec2390d49f91fbb632752c751039cca1fcfdde3018777763f9041e3a13b33793af1673a529f52ca0ecef1707a339a171feefd2c5f66be7a895edc6b7ba4c1d224594b5c7576632a58059e097095a97aca959afdaebb28381fbaf3fda2cbf405bdf3486e6d6cbefa411d617e14adcff7e6d2dd0f4b1ac6712723bebf0c483b40b4ed2a1ac2d6828488a6d2721ea87a2d58b92d8e6fff909e1089eaf8bab9e957b0ef7b78ad8ba1a12bd726722c6d4fdb68e1ee5deefd79cfbfb1df5f9d0b4a56d78b3986fe5656a069df8db47267c2acd887077d4c9c681f87459e7859d48c96ac0cb9b8c1f8a5ac0847c96bd513345a5ff93682f338d2a743fe967d1ac13212532258c3c1ed253aa48eaf13a39d05f9e154e4ffe6931b83cc5ecdd421b1de5d1734644d70675939cc163e9496eb67ee8d3cc260387f4442398d241b7ca1859f9cc74dee1c88b1bacd75ac739559c4c5ddbe6fa9f628607082d05688bc67085c0cd45cc472edfe2043e911cc4951d04cd4ac739b4becb868134cc3a86af08c5355d3e42c124f586cdb3b557904611d90159cacbd6f474b15ebfee1bcafa848b469e3795e452766555e179202d7927657a68b042f7ac07e921681d4860a826d06d6c96832fdef0247d36c4b8331683305c10d68555131fa5c2c026731c90eb482c16f1ebc3c3c8ef6cb17b2407191a380653c2d6f20e86eab86cfee8c37254b17e34410ce95e7ac482802562b53addcfefe788fab96082785c14603649200746c842d12c4f9f5a40fe8ac32cd6da386e73d491afb898efbb1fafb5ecc00673965cc316d17be6d78a4a548553bd3f91e804ef61d910ae3d708bd50caf5a437a8238717cbb9a215e3c398d498a78c5831282beab85d4be9633db185ccb2087dcb0b3d3be7c53b9db7c63604bc3ddb0508ab4252ff4392d0cae1cab7a7d01dc53442ea61f82133d371a41b8a0852525822134a04e1281a6d5f860f521534cecb97344beffa729b38bbbfaf77ffe833da7a54d9b4d9b34dc361296b912c57cb6da9e8f3eb282b2cd3b58202fe7485da433c0d3beefd8dbbcdda9f80b60f6df95be8546fe0b5dbfbc1899983ac421afa8701b3f8d1a1ffcc0fb66cfa0861f3369e03b48a37ff8e02eda891654ffb75cb54ad4cf38baa5f6061152c5486258ca1f93933f4f602dbf32e3b04f8c46633e034c2985f03b360509114bca23cc670fc060b72a3a7bade7f2f1e7b966d636d93a9308a776c17b24dbe99b02165a8b9596bb6495c903728c5a5223053f01a629e6f6b5848009b1f457fdff0545a1f38de61a4a4728f401ccc448b9757762a3d29e28b11005a0bee499444f3747113c5b95bb42fe7a6c85315188ea36f211e5f869f176be1be8b455f54a0ce0c721f6ad9c02ecf27bde0eb03a5303c65c00b30b9e9fdbe849fa9977377e9a181e4bb232d23f8a6f0b54d42b5222239b713b9e6ff70b38fe07410309c79539f1a58324c9d678ed87d60049feecf5689d8458b935b6aa4c5c1f38d50bffc49d593cc81c48380d66ebc1247e69bef58e14407c7971e457a9f70216622c462dac2d3e6519e592c4ca5dc6fd14948fdd93dbef867191ed9040aeb325250e7a7b4e0c299d1f56d0715b4b78a3010a8f2ce815d5433165cdf53f393778cc0b7c0561d2cb1bd1acad7d53889b5185a8dbd248538aa96f331fde1f29b90214b00a34c48e7216bce74d2051229cc13ae042d57dcc80c19a01eeb83e0199f03143d795540283bd426dc52aa55a7c984c6e3171ad6d2c9affb6fe16c7022270173bccd87faf40c9128f6ed2be8207dc1dd6ae41b052b8a360d7c503642aad1dd67b015a8328bcc4887b297a4fe7fdae7ac69573903171a40662717bb688c561452634ff8c21b049d5700045297b1e91eba24757e4cd308525b08c08d125db9a003b3768fd9975374c1f2069aea7f25fd61e44efb5d6e16014b265adf44777e6e9e59fe69d3461fec9eb8228d8f42eac0543e8f38192fbe0f9d491b54094062e99172bd1f230882e0d50f961347e9955380eff3c44fe293e59e4f8c70343b3d1668eba27ac6c2fe1a93f93d70849a556ea07a1f1fe3b64a8ffe78a55d7d7f407e616c9ede794271c5720bd435e07050c8c9ba5fa9a830439e739648aaf25543e8c946c2076f31f2028e5c1386df006344ceb74765df711f49ba0a81ff2b422b6b0b72aed890773f4ff069317f1ee97325f37f3fb81753aa2bcf26ca0386bd0a2046000925467537841a2755e7e3256c4117f7938b5e8326355640fec3d6365a8091320e1600318f2c807f01667dc7abfc5525d6af46ec503a7431a5967a5f905599db38ee16b6a1639eb2b4335ca57c1e5d6db0884119d2b348085ce74e82cf3a80508765cce6b083931d2089101c87498581cb9e632acf19fe1a8a35836950b817e2c9b5983633313fca9b324ca40d875e65c5df38bf2918386cfe475bb7eca655472effe17d8740fd068d5a1407af5127533a1f3bcd758722525ec7c857fc118089107dd65aed5d684b6b8034a86e9d76876a484019c8e6338b3e06226f21ae447204904d01ddeebe8d0f9428f756d97038c98ba09d90df6ddced1198beed88626dd580e15228d00821d11faa4f41d1035e1be0f80f2432f3fb93c6090a27e0fee57f8e806a144f2b436ce6e353f838eb764d13428a679ca9d0b543114fa512ad6bcd083a1235d8ed0bd6a31555463dbef1153b0530f6078ab66e1cbfb2bace81ac6672a446b72ab34c5bf39838a08a5ff5cfd438d5380c8b53aa33e7cabc8bfdfb10a436b79f900b05b574b5a867b29c65dd2723ae377e579aa9e0a9cb13abe05ccf992658acc8d15af98d89457840e4e580482e9f8c248a185b979b77f141c4e4725d28bdae4a97b865a6b15eaa7c01734e6060693f8badf5bba0bc71bed6", 0x1000}, {&(0x7f0000000280)='1', 0x1}, {&(0x7f00000002c0)="5bdf71fbc3a077dec2286391e7469790dc6664ea8d136976b7460e1743cd116203ea4212cd81e987b642c2167eb024f19b6751cb", 0x34}, {&(0x7f0000000300)="380b18c6658b12ea11b38f078272c66c4ff597454a5eff9fb4cf59ac4297290fbf03aa994ede8a81da5806da4fd42d84749892ed24e55be53e04feb70f5c6120758d3ec8165bb13db4112ee09d52422cf4d1c61538c4f5cb7b0d6bb210322af3b932bc6d0ccf05c801b98b8cba28fb92c712b0d3aa569187f113c2b19c30d345fe008ed553f4ddc511d6310ccd068626e9701990e510b2f80bf4d12d42480f5980f9916c4a4c2edf231f41aba26cb322c076c28f82d688f7d6ad6521", 0xbc}], 0x4}}, {{&(0x7f0000000640)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c, 0x0, 0x0, &(0x7f0000001880)=[@dontfrag={{0x14, 0x29, 0x3e, 0x9}}], 0x18}}], 0x2, 0x0) 00:25:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x8100}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:43 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f0000003b80)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0x0, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='$'], 0x28}}], 0x1, 0x80fe) 00:25:43 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0c0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:43 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_timeval(r0, 0x1, 0x43, 0x0, &(0x7f00000003c0)) 00:25:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xf000}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:43 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xffff}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0e0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:43 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_timeval(r0, 0x1, 0x2a, 0x0, &(0x7f00000003c0)) 00:25:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0f0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x3}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:43 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a100f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:44 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:44 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_timeval(r0, 0x1, 0xa, 0x0, &(0x7f00000003c0)) 00:25:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x74}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a480f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a4c0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:44 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, 0x0, 0x0) 00:25:44 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x2}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a600f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:44 executing program 3: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r0, &(0x7f00000069c0)=[{{&(0x7f0000004a40)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000004b80)=[{&(0x7f0000004a80)=';', 0x1}], 0x1}}], 0x1, 0x0) 00:25:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a680f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x3}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:45 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_timeval(r0, 0x1, 0x13, 0x0, &(0x7f00000003c0)) 00:25:45 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a6c0f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 575.537580][ T28] kauditd_printk_skb: 35 callbacks suppressed [ 575.537597][ T28] audit: type=1804 audit(1704327945.183:1504): pid=13454 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/659/cgroup.controllers" dev="sda1" ino=1959 res=1 errno=0 00:25:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x4}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a740f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:45 executing program 3: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$sock_timeval(r0, 0x1, 0x1e, 0x0, &(0x7f00000003c0)) 00:25:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a7a0f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:45 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 575.698626][ T28] audit: type=1804 audit(1704327945.343:1505): pid=13455 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/191/cgroup.controllers" dev="sda1" ino=1971 res=1 errno=0 00:25:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x6}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0011000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 575.811301][ T28] audit: type=1804 audit(1704327945.363:1506): pid=13455 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/191/cgroup.controllers" dev="sda1" ino=1971 res=1 errno=0 [ 575.913301][ T28] audit: type=1804 audit(1704327945.433:1507): pid=13464 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/660/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 [ 575.992084][T13473] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 576.010732][ T28] audit: type=1804 audit(1704327945.443:1508): pid=13460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/173/cgroup.controllers" dev="sda1" ino=1958 res=1 errno=0 [ 576.100586][ T28] audit: type=1804 audit(1704327945.443:1509): pid=13460 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/173/cgroup.controllers" dev="sda1" ino=1958 res=1 errno=0 [ 576.134344][ T28] audit: type=1804 audit(1704327945.673:1510): pid=13476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/661/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 00:25:46 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0012000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 576.437604][T13478] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:46 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:46 executing program 3: bpf$BPF_RAW_TRACEPOINT_OPEN(0xb, 0x0, 0x0) 00:25:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x7}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:46 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0002000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:46 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)={0x14, r1, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) [ 576.607262][T13486] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 576.615937][ T28] audit: type=1804 audit(1704327946.263:1511): pid=13488 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/662/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 00:25:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x8}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0003000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 576.750139][ T28] audit: type=1804 audit(1704327946.373:1512): pid=13480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/192/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:25:46 executing program 3: bpf$BPF_RAW_TRACEPOINT_OPEN(0x9, &(0x7f00000000c0)={0x0}, 0x10) [ 576.844290][ T28] audit: type=1804 audit(1704327946.393:1513): pid=13480 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/192/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 576.877103][T13483] __nla_validate_parse: 167 callbacks suppressed [ 576.877123][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. 00:25:46 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 576.909317][T13499] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 576.976009][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.017763][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.041946][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.067062][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.099365][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.123708][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.150994][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.177468][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. [ 577.206299][T13483] netlink: 988 bytes leftover after parsing attributes in process `syz-executor.2'. 00:25:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0004000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xa}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) [ 577.408746][T13507] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:47 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:47 executing program 3: r0 = socket(0x1d, 0x2, 0x7) getsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, 0x0, 0x0) 00:25:47 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xc}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0005000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:47 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:47 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x4, &(0x7f00000000c0)={&(0x7f0000000000)='rxrpc_abort\x00'}, 0x56) [ 577.589383][T13517] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xe}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0006000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:47 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=@newlink={0x40, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x4, @local}]}, 0x40}}, 0x0) [ 577.762432][T13527] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0007000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:47 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 577.862666][T13532] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 577.900582][T13534] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:48 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001780)={0x18, 0x3e3, &(0x7f0000000240)=@framed={{}, [@jmp]}, &(0x7f0000000340)='syzkaller\x00'}, 0x90) 00:25:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xf}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0008000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:48 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:48 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 578.484064][T13542] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x10}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0009000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:48 executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$MRT6_INIT(r0, 0x6, 0x1a, 0x0, 0x0) 00:25:48 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:48 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:48 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001780)={0x18, 0x1200, &(0x7f0000000240)=@framed={{}, [@jmp]}, &(0x7f0000000340)='syzkaller\x00'}, 0x90) 00:25:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000a000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0x60}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000b000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:48 executing program 3: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x4, &(0x7f0000000140)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}]}, &(0x7f0000000040)='GPL\x00', 0x9}, 0x90) 00:25:48 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:49 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x3}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000c000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:49 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:49 executing program 3: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00'}) 00:25:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x4}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:49 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:49 executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x3, &(0x7f0000000140)=@framed, 0x0}, 0x90) 00:25:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x8002}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000e000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:50 executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$MRT6_INIT(r0, 0x29, 0xc8, 0x0, 0x0) 00:25:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0x3}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0010000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:50 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 580.614677][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 580.614693][ T28] audit: type=1804 audit(1704327950.263:1550): pid=13611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/317/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:25:50 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0011000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:50 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:50 executing program 3: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getsadinfo={0x14, 0x23, 0x1}, 0x14}}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r0) 00:25:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0x18}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:50 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 580.651967][ T28] audit: type=1804 audit(1704327950.263:1551): pid=13611 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/317/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:25:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0x28}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) [ 580.777522][ T28] audit: type=1804 audit(1704327950.423:1552): pid=13619 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/674/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:25:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a0012000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) [ 580.930232][ T28] audit: type=1804 audit(1704327950.573:1553): pid=13632 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/675/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 581.020505][T13635] validate_nla: 6 callbacks suppressed [ 581.020525][T13635] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f020000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:50 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) [ 581.048918][ T28] audit: type=1804 audit(1704327950.583:1554): pid=13620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/196/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 00:25:50 executing program 3: r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', r1}, 0x48) [ 581.154665][ T28] audit: type=1804 audit(1704327950.583:1555): pid=13620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/196/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 [ 581.178661][T13639] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 581.217728][ T28] audit: type=1804 audit(1704327950.653:1556): pid=13616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/318/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 [ 581.299911][ T28] audit: type=1804 audit(1704327950.663:1557): pid=13616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/318/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 [ 581.375030][ T28] audit: type=1804 audit(1704327950.683:1558): pid=13631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/178/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 [ 581.418662][ T28] audit: type=1804 audit(1704327950.693:1559): pid=13631 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/178/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:25:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f030000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc, 0xa, 0x0, 0x0}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:25:51 executing program 3: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000380)={'ip6_vti0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x29, 0x0, 0x0, 0x0, 0x0, @remote, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}) 00:25:51 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) 00:25:51 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:25:51 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x2}]}]}, 0x94}}, 0x0) [ 581.795333][T13652] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:51 executing program 3: r0 = socket$qrtr(0x2a, 0x2, 0x0) recvmsg$qrtr(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {0xfffffffffffffffe}], 0x2}, 0x38, 0x0) 00:25:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f040000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x3}]}]}, 0x94}}, 0x0) 00:25:51 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) [ 582.016393][T13664] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f050000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:51 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x5}]}]}, 0x94}}, 0x0) [ 582.240020][T13675] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f060000ba8000001201", 0x2e}], 0x1}, 0x0) [ 582.671366][T13682] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:52 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x6}]}]}, 0x94}}, 0x0) 00:25:52 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:25:52 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f070000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:52 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x7}]}]}, 0x94}}, 0x0) 00:25:52 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 582.838623][T13692] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f080000ba8000001201", 0x2e}], 0x1}, 0x0) [ 582.973841][T13699] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x8}]}]}, 0x94}}, 0x0) 00:25:52 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:52 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:25:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f090000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x9}]}]}, 0x94}}, 0x0) 00:25:52 executing program 3: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 583.248562][T13709] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:53 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:53 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:25:53 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0a0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:53 executing program 3: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0xf}}, 0x0) 00:25:53 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:25:53 executing program 3: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x10}}, 0x0) [ 583.888962][T13727] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0c0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:53 executing program 3: socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x140}}, 0x0) 00:25:54 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:54 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0xec0}}, 0x0) 00:25:54 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0e0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 00:25:54 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:25:54 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:54 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0f0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 00:25:54 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x33fe0}}, 0x0) 00:25:54 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f100000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:54 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) 00:25:54 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:25:55 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f480000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0xfffffdef}}, 0x0) 00:25:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 00:25:55 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000100000000000000e9ff000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='sys_exit\x00'}, 0x10) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000040)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) recvmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000001500)=[{0x0}, {0x0}], 0x2}}], 0x1, 0x0, 0x0) 00:25:55 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f4c0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 585.744581][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 585.744598][ T28] audit: type=1804 audit(1704327955.393:1608): pid=13781 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/690/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:25:55 executing program 1: r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getsadinfo={0x14, 0x10}, 0x14}}, 0x0) 00:25:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x2}, 0x0) 00:25:55 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 585.873483][ T28] audit: type=1804 audit(1704327955.523:1609): pid=13778 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/183/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 00:25:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f600000ba8000001201", 0x2e}], 0x1}, 0x0) [ 585.991204][ T28] audit: type=1804 audit(1704327955.553:1610): pid=13778 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/183/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 [ 586.064270][ T28] audit: type=1804 audit(1704327955.613:1611): pid=13784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/201/cgroup.controllers" dev="sda1" ino=1969 res=1 errno=0 [ 586.109295][ T28] audit: type=1804 audit(1704327955.613:1612): pid=13784 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/201/cgroup.controllers" dev="sda1" ino=1969 res=1 errno=0 [ 586.110133][T13799] validate_nla: 6 callbacks suppressed [ 586.110148][T13799] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 586.138010][ T28] audit: type=1804 audit(1704327955.703:1613): pid=13796 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/691/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:25:56 executing program 1: bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x6, &(0x7f00000000c0)={&(0x7f0000000000)='rxrpc_abort\x00'}, 0x56) 00:25:56 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x4}, 0x0) 00:25:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 00:25:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f680000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:56 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) 00:25:56 executing program 1: r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x3000000000000, 0x300}, 0x0) [ 586.682053][ T28] audit: type=1804 audit(1704327956.323:1614): pid=13802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/692/cgroup.controllers" dev="sda1" ino=1963 res=1 errno=0 00:25:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x7}, 0x0) [ 586.780183][T13809] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f6c0000ba8000001201", 0x2e}], 0x1}, 0x0) [ 586.805058][ T28] audit: type=1804 audit(1704327956.453:1615): pid=13808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/184/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 00:25:56 executing program 1: r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x14, r0, 0x1}, 0x14}}, 0x0) 00:25:56 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) [ 586.877341][T13808] __nla_validate_parse: 202 callbacks suppressed [ 586.877361][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. 00:25:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x600}, 0x0) [ 586.917367][ T28] audit: type=1804 audit(1704327956.453:1616): pid=13808 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/184/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 [ 586.951017][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 586.992293][T13823] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 587.025666][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.039597][ T28] audit: type=1804 audit(1704327956.563:1617): pid=13816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/693/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 587.095204][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.134584][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.152532][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.175178][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.192019][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.206226][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. [ 587.220508][T13808] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.0'. 00:25:57 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x0, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f740000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:57 executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x300}, 0x0) [ 587.520620][T13832] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:57 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x0, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0xffffff1f}, 0x0) 00:25:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f7a0000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:57 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001580)={&(0x7f0000001400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xa, 0xc, 0x2, [@struct]}}, &(0x7f0000001480)=""/198, 0x26, 0xc6, 0x1}, 0x20) 00:25:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x2}, 0x0) [ 587.680702][T13842] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:57 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x0, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:25:57 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000180)=@framed={{0x18, 0xb}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096}, 0x90) 00:25:58 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:58 executing program 1: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000015c0), 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r0, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 00:25:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000ff00000ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x18, 0x6a, 0x1}, 0x18}}, 0x0) [ 588.478942][T13859] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:58 executing program 1: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000015c0), 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0, 0xffffffffffffffff}, 0x4) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000340)={&(0x7f0000000040)="19", &(0x7f0000000140)=""/233, &(0x7f0000000240), &(0x7f0000000280), 0x800, r1}, 0x38) 00:25:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x3}, 0x0) 00:25:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x18, 0x6a, 0x1}, 0x18}}, 0x0) 00:25:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f210100ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:58 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x4}, 0x0) 00:25:58 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x18, 0x6a, 0x1}, 0x18}}, 0x0) 00:25:58 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x6, &(0x7f0000000140)=@framed={{}, [@tail_call={{0x29}}]}, &(0x7f00000001c0)='GPL\x00', 0x7, 0xc8, &(0x7f0000000200)=""/200}, 0x90) [ 588.712543][T13870] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:59 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000300ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8}]}, 0x20}}, 0x0) 00:25:59 executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@enum]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, 0x1}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x0, 0x0, 0xbed}, 0x10}, 0x90) 00:25:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6}, 0x0) 00:25:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8}]}, 0x20}}, 0x0) 00:25:59 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0xf, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096}, 0x90) [ 589.485169][T13887] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:25:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x7}, 0x0) 00:25:59 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:25:59 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x11, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x48}, {}, {}, [@cb_func]}, &(0x7f0000000300)='GPL\x00', 0x1, 0xfe, &(0x7f0000000340)=""/254}, 0x90) 00:25:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000500ba8000001201", 0x2e}], 0x1}, 0x0) 00:25:59 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8}]}, 0x20}}, 0x0) [ 589.812312][T13902] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 590.024975][T13904] netlink: 'syz-executor.0': attribute type 72 has an invalid length. 00:26:00 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:00 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x8}, 0x0) 00:26:00 executing program 3: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x9, &(0x7f0000000140)=@framed={{}, [@alu={0x4}, @tail_call]}, &(0x7f00000001c0)='GPL\x00', 0x7, 0xc8, &(0x7f0000000200)=""/200}, 0x90) 00:26:00 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x9c00}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096}, 0x90) 00:26:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000600ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000700ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:00 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xa}, 0x0) 00:26:00 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x0, 0x2}]}]}}, &(0x7f0000000480)=""/145, 0x2e, 0x91, 0x1}, 0x20) 00:26:00 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000002900)={0x0, 0x0, &(0x7f0000002840)=[{&(0x7f0000001640)="f5", 0x1}], 0x1}, 0x0) recvmsg$unix(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000200)=""/18, 0x12}], 0xa}, 0x0) 00:26:00 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}, &(0x7f00000001c0)='GPL\x00', 0x7, 0xc8, &(0x7f0000000200)=""/200}, 0x90) 00:26:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000900ba8000001201", 0x2e}], 0x1}, 0x0) [ 590.782253][ T28] kauditd_printk_skb: 23 callbacks suppressed [ 590.782270][ T28] audit: type=1804 audit(1704327960.433:1641): pid=13922 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/206/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 590.874419][ T28] audit: type=1804 audit(1704327960.473:1642): pid=13919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/206/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 591.084635][ T28] audit: type=1804 audit(1704327960.733:1643): pid=13930 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/188/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 591.111588][ T28] audit: type=1804 audit(1704327960.743:1644): pid=13930 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/188/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 591.168228][T13931] validate_nla: 124 callbacks suppressed [ 591.168248][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.191610][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.203909][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.216554][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.231789][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.245135][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.257594][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.269078][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.283559][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. [ 591.296559][T13931] netlink: 'syz-executor.0': attribute type 72 has an invalid length. 00:26:01 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:01 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xc}, 0x0) 00:26:01 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@const, @const={0x3}]}, {0x0, [0x0, 0x0]}}, &(0x7f0000000200)=""/184, 0x34, 0xb8, 0x1}, 0x20) 00:26:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000a00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:01 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x5}}, &(0x7f00000001c0)='GPL\x00', 0x7, 0xc8, &(0x7f0000000200)=""/200}, 0x90) 00:26:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f9e0b00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:01 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001580)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0x2}]}}, &(0x7f0000001480)=""/198, 0x26, 0xc6, 0x1}, 0x20) 00:26:01 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x6, 0x13, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x4}, {}, {}, [@func, @cb_func, @func]}, &(0x7f0000000300)='GPL\x00', 0x1, 0xfe, &(0x7f0000000340)=""/254}, 0x90) [ 591.597082][ T28] audit: type=1804 audit(1704327961.243:1645): pid=13937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/703/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 [ 591.793993][ T28] audit: type=1804 audit(1704327961.443:1646): pid=13941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/207/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 591.873923][ T28] audit: type=1804 audit(1704327961.443:1647): pid=13941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/207/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 591.902454][T13941] __nla_validate_parse: 506 callbacks suppressed 00:26:01 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:01 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xe}, 0x0) 00:26:01 executing program 3: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) close(r0) 00:26:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f9f0b00ba8000001201", 0x2e}], 0x1}, 0x0) [ 591.902469][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 591.942919][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 591.982475][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 591.983525][ T28] audit: type=1804 audit(1704327961.633:1648): pid=13954 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/704/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 [ 592.053932][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.093072][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.107961][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.123563][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.137540][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.167992][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.189745][T13941] netlink: 1004 bytes leftover after parsing attributes in process `syz-executor.2'. [ 592.194769][ T28] audit: type=1804 audit(1704327961.843:1649): pid=13956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/189/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 [ 592.247422][ T28] audit: type=1804 audit(1704327961.853:1650): pid=13956 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/189/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 00:26:02 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:02 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x90) 00:26:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000fa00b00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf}, 0x0) 00:26:02 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001580)={&(0x7f0000001400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x0, 0x0, 0x0, 0xc}]}}, &(0x7f0000001480)=""/198, 0x26, 0xc6, 0x1}, 0x20) 00:26:02 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x3, &(0x7f0000000180)=@framed={{}, [], {0x95, 0x0, 0x0, 0x1100}}, &(0x7f0000000240)='syzkaller\x00', 0x6, 0x1000, &(0x7f0000000580)=""/4096}, 0x90) 00:26:02 executing program 3: socketpair(0x11, 0x2, 0x320, &(0x7f0000000080)) 00:26:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x10}, 0x0) 00:26:02 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000fa10b00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:02 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000002c0)={&(0x7f0000000080)=@abs, 0x8c, &(0x7f0000000240), 0x0, &(0x7f0000000100), 0x20}, 0x0) 00:26:02 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000001980), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'pimreg0\x00', 0x1}) 00:26:03 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x60}, 0x0) 00:26:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000c00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:03 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x4, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0x3}]}]}, {0x0, [0x0, 0x0]}}, 0x0, 0x30}, 0x20) 00:26:03 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26, 0x0, 0x1}, 0x20) 00:26:03 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000400)={&(0x7f0000000100)=@abs={0x1}, 0x6e, 0x0}, 0x0) 00:26:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf0}, 0x0) 00:26:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000e00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:03 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:03 executing program 3: bpf$OBJ_GET_MAP(0x7, &(0x7f0000000f80)=@generic={&(0x7f0000000d40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}, 0x18) 00:26:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) ioctl$TUNGETSNDBUF(r0, 0x800454d3, &(0x7f0000000040)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c55bcaf0000000a000000090000ff000000080000000000000000000900"], 0x0, 0x2e}, 0x20) r1 = openat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) openat$cgroup(r1, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.net/syz0\x00', 0x200002, 0x0) mkdirat$cgroup(r2, &(0x7f0000000140)='syz0\x00', 0x1ff) 00:26:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x300}, 0x0) 00:26:04 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:04 executing program 3: bpf$BPF_BTF_LOAD(0x6, &(0x7f0000000500)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}, {0x0, [], 0x2}}, 0x0, 0x1a}, 0x20) 00:26:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000f00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x326}, 0x0) 00:26:04 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}}, 0x0, 0x2e, 0x0, 0x1}, 0x20) 00:26:04 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x1, 0x0, 0x5, 0x1, 0x0, [{0xe}]}]}}, &(0x7f0000000540)=""/206, 0x32, 0xce, 0x1}, 0x20) 00:26:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f001f00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:04 executing program 1: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg(r0, &(0x7f00000004c0)={&(0x7f0000000080)=@caif, 0x80, 0x0}, 0x0) 00:26:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x600}, 0x0) 00:26:04 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x8941, &(0x7f0000000300)) 00:26:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f002000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:04 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0x6, [@func_proto={0x0, 0x3, 0x0, 0xd, 0x0, [{0x4}, {0xb}, {0x5, 0x5}]}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xf, 0x5}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0]}}, 0x0, 0x56, 0x0, 0x1}, 0x20) 00:26:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x700}, 0x0) 00:26:05 executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f0000000400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int]}}, 0x0, 0x2a}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r0, 0x20, &(0x7f00000001c0)={&(0x7f0000000540)=""/4096, 0x1000, 0x0, 0x0}}, 0x10) 00:26:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f012100ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:05 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:05 executing program 3: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x8901, &(0x7f0000000300)) 00:26:05 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:05 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x4}]}]}}, 0x0, 0x32, 0x0, 0x1}, 0x20) 00:26:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f003f00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xa00}, 0x0) 00:26:05 executing program 3: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x8940, 0x0) 00:26:05 executing program 3: mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) [ 595.839185][ T28] kauditd_printk_skb: 18 callbacks suppressed [ 595.839202][ T28] audit: type=1804 audit(1704327965.493:1669): pid=14044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/192/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 00:26:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f004800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xc00}, 0x0) 00:26:05 executing program 1: bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000f80)=@generic={&(0x7f0000000d40)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}, 0x18) [ 595.969561][ T28] audit: type=1804 audit(1704327965.493:1670): pid=14044 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/192/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 00:26:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f004c00ba8000001201", 0x2e}], 0x1}, 0x0) [ 596.050857][ T28] audit: type=1804 audit(1704327965.513:1671): pid=14052 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/713/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 [ 596.128581][ T28] audit: type=1804 audit(1704327965.513:1672): pid=14046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/211/cgroup.controllers" dev="sda1" ino=1942 res=1 errno=0 [ 596.173260][ T28] audit: type=1804 audit(1704327965.513:1673): pid=14046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/211/cgroup.controllers" dev="sda1" ino=1942 res=1 errno=0 [ 596.210516][T14048] validate_nla: 327 callbacks suppressed [ 596.210536][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.225678][ T28] audit: type=1804 audit(1704327965.783:1674): pid=14062 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/714/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 596.238653][T14066] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 596.292449][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.306435][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.321421][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.336582][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.355995][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.368013][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.382550][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. [ 596.394848][T14048] netlink: 'syz-executor.2': attribute type 72 has an invalid length. 00:26:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xe00}, 0x0) 00:26:06 executing program 3: openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x3c1, 0x0) 00:26:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f655800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:06 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x8912, 0x0) 00:26:06 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf00}, 0x0) 00:26:06 executing program 3: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x1000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) 00:26:06 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 596.590531][ T28] audit: type=1804 audit(1704327966.223:1675): pid=14069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/715/cgroup.controllers" dev="sda1" ino=1966 res=1 errno=0 00:26:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x2603}, 0x0) 00:26:06 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@typedef={0x0, 0x2}]}}, 0x0, 0x26}, 0x20) 00:26:06 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x4020940d, &(0x7f0000000300)) [ 596.751629][ T28] audit: type=1804 audit(1704327966.393:1676): pid=14079 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/716/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 [ 596.833633][ T28] audit: type=1804 audit(1704327966.483:1677): pid=14075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/193/cgroup.controllers" dev="sda1" ino=1977 res=1 errno=0 00:26:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f586500ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:06 executing program 3: openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x3, 0x0) 00:26:06 executing program 1: syz_open_procfs$namespace(0x0, &(0x7f0000001740)='ns/ipc\x00') 00:26:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x5865}, 0x0) [ 596.968766][ T28] audit: type=1804 audit(1704327966.483:1678): pid=14075 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/193/cgroup.controllers" dev="sda1" ino=1977 res=1 errno=0 00:26:06 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:06 executing program 3: bpf$PROG_BIND_MAP(0x9, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff, 0x22}, 0xc) [ 597.184938][T14090] __nla_validate_parse: 903 callbacks suppressed [ 597.184958][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.271959][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.290802][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.314947][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.331511][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.362515][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.380392][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.395283][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.414895][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. [ 597.427391][T14090] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.2'. 00:26:07 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6000}, 0x0) 00:26:07 executing program 1: bpf$PROG_BIND_MAP(0x9, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff, 0x13}, 0xc) 00:26:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006c00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:07 executing program 3: bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000900)={@ifindex, 0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 00:26:07 executing program 3: syz_open_procfs$namespace(0x0, &(0x7f0000001700)='ns/mnt\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') 00:26:07 executing program 1: r0 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x2, &(0x7f0000000300)) 00:26:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6558}, 0x0) 00:26:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f007400ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:07 executing program 3: socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(r0, &(0x7f0000000080)={[{0x0, 'net_cls'}]}, 0x9) 00:26:07 executing program 1: bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0xf, &(0x7f0000000040)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, 0x1}}}, &(0x7f0000000200)='GPL\x00', 0x4, 0x45, &(0x7f0000000240)=""/69, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000002c0), 0x8}, 0x90) 00:26:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x8100}, 0x0) 00:26:08 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f007a00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:08 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@base={0x10, 0x0, 0x0, 0x10000, 0x0, 0x1}, 0x48) 00:26:08 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:08 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {&(0x7f0000000140)=""/90, 0x5a}, {&(0x7f0000000240)=""/220, 0xdc}], 0x3, 0x0, 0x110}, 0x0) sendmsg(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000940)="23510acf692055efa53df22251d2b17c29b1cbd0f49ed25f577abd76730d624f3a646de1d0a04e8811b11ec2f6f485cdb500ea8720bc67953ae8bc0c1fb9797da74e360107721189ffe973dc65bd756444588798492b8e33c5f65a", 0x5b}], 0x1}, 0x0) 00:26:08 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf000}, 0x0) 00:26:08 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x34000}, 0x0) 00:26:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f008100ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:08 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000001540)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=""/4096, 0x1000}, 0x40) 00:26:08 executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f00000024c0)={0x0, 0x0, 0x0}, 0x42) 00:26:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0b9e00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:08 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003500)=[{0x10}], 0xf}, 0x0) 00:26:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0b9f00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:08 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x400300}, 0x0) 00:26:08 executing program 3: socketpair(0x10, 0x0, 0x7f, &(0x7f0000000000)) 00:26:09 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:09 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf0ffff}, 0x0) 00:26:09 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000180)=""/174, 0x1000000, 0xae, 0x1}, 0x20) 00:26:09 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:09 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000001540)={0x0, 0x0, 0x0}, 0x40) 00:26:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0ba000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0ba100ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:09 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x1000000}, 0x0) 00:26:09 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x0, 0x0, 0x0, 0x0, 0x4, 0x1, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x48) 00:26:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00f000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:09 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x2000000}, 0x0) 00:26:09 executing program 3: sendmsg(0xffffffffffffffff, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000840)=[{0x20, 0x0, 0x0, "ab790cca336ce31d1173efc3ffd7de8f"}], 0x20}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f0000000580)={&(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000540)=[{0x0}], 0x3e5}, 0x0) 00:26:10 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x3000000}, 0x0) 00:26:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000200ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:10 executing program 1: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)}, 0x50) 00:26:10 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@ptr]}}, &(0x7f0000000180)=""/174, 0x26, 0xae, 0x1}, 0x20) 00:26:10 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x10120) 00:26:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x4000000}, 0x0) 00:26:10 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) r1 = gettid() r2 = gettid() sendmsg$unix(r0, &(0x7f0000001680)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@cred={{0x1c, 0x1, 0x2, {r1, 0x0, 0xee01}}}, @cred={{0x1c, 0x1, 0x2, {r2, 0xee00, 0xee00}}}], 0x40}, 0x0) 00:26:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000300ba8000001201", 0x2e}], 0x1}, 0x0) [ 600.870865][ T28] kauditd_printk_skb: 26 callbacks suppressed [ 600.870883][ T28] audit: type=1804 audit(1704327970.523:1705): pid=14198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/216/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 00:26:10 executing program 1: socketpair(0x10, 0x0, 0x8000, &(0x7f0000000000)) 00:26:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6000000}, 0x0) [ 600.981101][ T28] audit: type=1804 audit(1704327970.523:1706): pid=14198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/216/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 [ 601.072614][ T28] audit: type=1804 audit(1704327970.573:1707): pid=14211 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/729/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 601.100116][ T28] audit: type=1804 audit(1704327970.683:1708): pid=14209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/197/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 [ 601.127640][ T28] audit: type=1804 audit(1704327970.683:1709): pid=14209 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/197/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 [ 601.156509][ T28] audit: type=1804 audit(1704327970.693:1710): pid=14216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/730/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:26:11 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000400ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:11 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x7000000}, 0x0) 00:26:11 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup(r0, &(0x7f0000001580)='syz0\x00', 0x200002, 0x0) 00:26:11 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f00000025c0)=""/4096, 0x1000}, {&(0x7f00000003c0)=""/83, 0x53}], 0x2}, 0x0) sendmsg(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000010c0)="3cf40c166212551df53b09e7eb72fec627aa431259550ac6283f00d2e74a1f9f646e800341c039abceab53f381f27bd8669ff3dafe1d8fc608fd869e9fc9dce7df465a54b7572e174c56c888b4ebb29b253c3db9de5d5657f250ebec0fa7e0be5e83a65ec10998539489a4489d8f34dce9868a2a11b3f5296aff78153924c2f4dd9d580615b7f5462ac4f9e72980c300ba97419a43b0ec1a9cbd13ef35d93ca4cfa2effeca7907f6134a50a8e2e71eb406b425aa47dcf9ff7922f4b2e1cd8b5a0282dc3a8b62325a572471830c2e9d036b243795a1f34b7cb5e440e9e368d1d98ea09c7ad52fbc4785993c6365faa9ed1eb4ecbe209333b130eb21695509f0591ba37c81a1652ebe255cf4eab5ab233244c0d7fb1a655b6cc994321fcdff05c0a94f6b4be0cfaa97ad93b26acae92a904c232223895a1e78bf8bb26ddfb42f5828e3e7f39cdb558e77620182d589fb3455f5b34c59b5a679902dab935026daab50f39c32b4451df0cf362ff7668a4a2799b33cc4b14e73d04797152bfc326d6d638896ffa41b2a591a102aa47370194666754af4de597c2f90a9bdc31ac8c116cbe21945bbfd440d509bc15f39de4989c28d18d1c8a98f5c15efc0f57a0a0331df0211ebafbe45ffccb44ee6e11e771e04ba5c2528bbc36cb79d76f53dad8577ef8a35416c5a3768e2a666ef92d545306d2486d0f5092a2b9db9daca693935d24082e05c4ef02331c1bcce486110c3bacf13d5030e368adfeaa9b278cd9699071b284d14360425f3395084687c87b3772b0db6d475cf2befab2869c6b78b672a38f6d1e6562ef697d3243c0d029bc672f4336d27ff5c86f2367c0d878df4973728610c165eaed29bb5991596064fec02569405f587bf0b462fcf091641852aaf9619b77d85eafa417c9a8b961e770bd30d5663941d34e23357a0aec96e4f58f88cc1ca024b0d71c985583271aecd64e652099bf7a21154365d3c88d006199da80d69ecd9da61fd24e5b9385e84aee7ecb86a2d239ea4e7afff45c9870ba31355bb5cc071dc1d02ed30b0849f7501ae3f0e312579f15975d426f5969bc8ce7a15d25c23514afc003d76ee61bdb188ee3b86652d273948f09c54b56fb016ed6ac63dab4d60654190e2045b2cbfa66a99042c52beef078181dbd8793968d14e614217c8888b043117b089e78ccec0607985de24b5f27989df2683f48e9117f3f4e21570b40e8d2e1aac4e2b66c233b126dbf8ff5d267cba1b9c30e7b9e2960c109651c2dfe6c43156b9d9e23ad3006b1676d3b93c40d8a463b9cd2e086a4a4dd033b6f44aff6f72c35996582284536984adee400d23b7f28601f731ec83978979b5d9ee3b503dc002246c8c33ee5b5141365c492e9d284e3144bbfbe53490f11c4a754e6ad23ec9fe01c029e93cf824ea79cb06519fcb594d9297ed749f67361779222776e0763666c56fe754d07a12583da2eb2eebfbda58152d36e3dcc7b4b9ce3e9751dde57f47bd50a39c50ce8e0c6e8099d1761c28ad477f7a51696d2be1898e62942b4a3fea63823e68cb3e167ecf669e997d942e5cb46964b1f507f533b908bf8103e39cbba1e2523df0a2daaec4f5eb73c344170d055501a33359ccb841044614942ba1ad54ecb54f366a4a833ca4079654b5f02001e242a8f25e67964e6da59f936fce3b36de093b0a0511bfc466241b495bf665fad5a3dfaf78eaa1ad0ffa566cd28a8e3c9b0cc8f2d3848bd049dfe4c210490632f475a274748501d85013c7b4882390addf469103ac9cc529a1d8e3870720fc55a26ff3578c511d773a95089dad3c23d3ebc95f226ccc1c6a82bd1e19f2cb6cc402f7b75bea17bb65a68ec5094df8fe3ecf6595688aaea172386bbaf082cd2e47021a2aa8f4e2e3c8cb410bae931e16def80319c66a1b6befbab3dc8685c014105919da319ab92b512b8af0e37a946cd3a3cb21637ef630ba1f36e6bb4bd3391056520254de0ca1eb70424cd905d5fa126181c0499df2d0e594c3351c16ac7d85ce261e2184cb8c9b042c939a86cca0a9e96e106852d8ec75732297191c4ef4bf2a6c9b53fefaf3d5351b32a87776a2b4253b6612609fc69aad6d21d226ed26bf2355ee5ffee31bdd9229c5a9f36702e0142f49a2e08afcd5918c549f58ebdd5edbe8b1dc507ccf7c1debd852faca7992aec4f347c111ff0bb748b8bf8f343e1a04d74cf7abe581f658bd0e5bdaf4f0d95135e613ad2c4d17aed52ced577e3dba39b59a2659a6f816c0a23ef9b980ceef71eb5723ccdf5cafce1ce1d608e1b1adcc6ca381fd82958d17309452bceb8683f8aee95444f2f6ce3c5a76ebbdd3aa990a87a8e81838c46e527013cc3a93908ab3f3a2d1e2ea7b228441b86802b31d798cb2ea2d757f7c5f4728ee805c0010ffc437f25c38039af33a9daa28c9e3810a0d9b64185d8691f534f5267ab6d8efd711685d3d2eacbee8c0a8de77c0857bf7b5c86fbfdf19e1cbe0c1024c74d3411374738b59a98220bfe5297e7b991469e422bc21a70a76d96a7a3120c36e9421bb6817f2b7ee104036a0393534495fc44e368d746c3162be0f060eb48a4a1e70da26cdc91f7c36b6cbd63d801ea5e026e54ff4a95a98af049d2b7689b511e82c1d01cbb846c21fd099efa4294519b6d6705e6443e475ea569744d6ba8e132bb49c762b8f0f4d1aec184b364a861e29b0887baf0ad46bff579d5d0163c3e4bb117aff9fef3296baaafcda0c60959968db92a4de9b97b3c6b3476490f04c871891157da6785549e06f361323af734070116a199e698c166455c67d2a8124bd35b625d62ffee20e8e40b02c1ab0724defe9462a14bc3b4acf972e2b0c82e44dba97dc7875120cb2b0ff768e16de18f9f259103993941025351d24eb78c404483abe52523324747ff7eb4d8d114b3d1263534c28036bf1b1e1e57551d3e2adaaeb13ea8a9ca0d50bf8fd6b7d27e1db7770dd932f152cc803971449f49be67485a7c13a1498978ae59584962a7f15e1a0ee460805b2a809c3929bee85c8f624109249843552ac04f574f60ddffd964ac25145b973c3223af5ce1045d65992247a0f0202bd61c2b800b917067289efbb4221764b2f99c648d98fd06b9f18051a1667584c7efc0268770f7582644566f82d38c55d82202776d8de6d8667a7766b5fc6f4091802f3ad7e0c329120f4163ef767cec0ac7e17171ad3fd922140e6ea06de7a9c3acde59e26c5f11c70e47584976a34248e63a3878c2e0f469f7d963a1809f21d472bf0cc14bf2857c195a08de7c944ccedb64b82fa11ec2042b38b0115023b65b58541999d6fcaa61e304aa33225e3c9b2f95b7fefedc3dd2d7f7455afb9845207bb6ed64a2357f97273178088ee8ce3f7353fa101bf00fec84a438375c2a9ae20f769961a03c83b27bafc4084d5e17f12aabedd67b483fc1b9388e068322b6c863de29e71ab99e68256783705a1f451f667bc5b670457427cfc3e01a36e3e7716e8e08867aa28c00fc95e1fd0edd8b6b1c2e07752cda6b9581ed47923e1d53c8811307490c4f7b9bcb12e9594104e6fb923d65eacd6aa8f9384b7fafa09e1ce609bb1aed1c4cfd79f81d68053e1711e7bd5649864d90d55ac6031fd9d2880b1ca07b9ec68fb64236a4ef1d7aa2a730bbbb0b806306986a68242ba5dc29eef1bfbec995a103bc2193af225d9f1ff49657971c08b69359df6b2", 0xa41}], 0x1, &(0x7f00000020c0)=ANY=[@ANYBLOB="c0000000000000000d010000080000008a5cb66ef581d0b995800e79710375670f3414fdb08ab421c38e8dc0095c34401c9527f161e4c0e42f491a0e3a9bdb2b2ac915e9436d2f36741a7d0a848b24948e0b4768f738b862e15814159fdbcdf0cdba221bb6b8eb1f9347e68796e2291a3b4008ada2e9f46cb9cb0b6756eaab828d59d0117b607d67c82a0f8a4650956fe3474aebfb99044d3be065f53e446e3fe08fedaf5fa3c1ae3b6b0ba6950dc630134edbf0bc5eb0d20515bf000000000018000000000000000301000081000000c481868100000000a80000000000000012010000400000000316fab2fbad99bd5886398035749800ff311cc2e5685fda76d0f3d1f58172ecd1486b27af09185763c32cc42c229bf7e047800815b0c4edc758b320b5709136c6a9ac15a7b514eaa5c2619f18528a5c6f1b2643b7436e75cc224fb89296ef401aba89542829d24274dbc04a8042c0d66327f7057f69622604273a54982e9eff942ba384de709843b722c045d5b604e56300000000000000580000000000000007000000ff7f0000a16e3bce24aa7c2984b87f9cdf6f3f66fb8a815cd4f62fe34cf328bec11118c57952427ff80e4b84b6d84180561b26b666b9d8c4276dca904d8002d43c97d0fa2ac510ef000000006800000000000000070100000200000007fdf424fe901bc154df48a600500f0d6281503e8e3403a6fa10769bb877bd3fa7a40e39bcd4fbf5e82974d52afeabab886d621ca224cc4006e51ece73678c7c58a545d629d1e451271bf9e4a7dfb3acf5ccd9ef76580000c8000000000000000e0100000010000055a372ae818bad56142eb30af920f23f88174d0953233a2561cde8dcc5fc94f40c3e664adb5c586d5c1f4586ddfed01757784d5300cf16833068cc4eb2aca490fe6a37125ed4ee94c5b08a41d12b353e5144108cb4f255903b4745a5ee962d5029d0b756dd5f455854af81958522dd6f9d70a5ff6659825377dbff6f26b949d0285aab569598ea18758492639b0cd411d6f900be4cbd4ff3ab89c10b82df80c467e4911b565527c23e2a7a71bdceb68565118a000b000000e00000000000000014010000020000008c1ef42941ea694f562aa6261ce2695349a4c87a9002ae5a882406ef670a3840673161d4d4e8648afb9acd896f5d5d69c75daa24bcc2eaad479d3e1455b89f333281796eacd9a14b88f2cc13b9838529eda372e09e4e93be73092adbedf1e7c1fa041f51bf4ae92f79254ba0f1c1c117a83546925b646e1e210c0cde911f8687e8ae13fdace5bd3844527210144bbde388c6a72e8518a5d73425566420e4c8d441852b473e477eb90e89b981afe0ad92e9a71a7dd464c5c2b7d585bdbf76759e3c6f392b09dd61c40f1eb692e7fe1e000001"], 0x4e8}, 0x0) [ 601.624492][T14222] validate_nla: 117 callbacks suppressed [ 601.624511][T14222] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:11 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 601.652935][ T28] audit: type=1804 audit(1704327971.303:1711): pid=14223 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/731/cgroup.controllers" dev="sda1" ino=1967 res=1 errno=0 00:26:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) 00:26:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000500ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:11 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x8000000}, 0x0) [ 601.810431][ T28] audit: type=1804 audit(1704327971.463:1712): pid=14225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/198/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 601.867459][T14232] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:11 executing program 1: bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000006c0)='X'}, 0x50) 00:26:11 executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)=[{0x0}, {&(0x7f00000010c0)=""/4096, 0x1000}], 0x2, 0x0, 0x110}, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000640)='6', 0x1}], 0x1}, 0x0) [ 601.900848][ T28] audit: type=1804 audit(1704327971.493:1713): pid=14225 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/198/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 00:26:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000600ba8000001201", 0x2e}], 0x1}, 0x0) [ 601.989296][ T28] audit: type=1804 audit(1704327971.603:1714): pid=14238 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/732/cgroup.controllers" dev="sda1" ino=1945 res=1 errno=0 [ 602.038123][T14242] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000700ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xa000000}, 0x0) 00:26:12 executing program 1: bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000100)='k', 0x0}, 0x50) 00:26:12 executing program 3: socketpair(0x11, 0xa, 0xffffff00, &(0x7f0000000240)) 00:26:12 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 602.642140][T14253] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:12 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:12 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000002c0)={&(0x7f0000000000)=@can, 0x80, 0x0}, 0x40012002) close(r1) 00:26:12 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003500)=[{0x1c}], 0x10}, 0x0) 00:26:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xc000000}, 0x0) 00:26:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:12 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000280)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@ptr={0x5}]}}, &(0x7f0000000180)=""/174, 0x26, 0xae, 0x1}, 0x20) 00:26:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xe000000}, 0x0) 00:26:12 executing program 1: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380), 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0xac, &(0x7f0000000580)}, 0x10) [ 602.871128][T14266] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000900ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:12 executing program 3: socketpair(0x15, 0x0, 0x0, &(0x7f0000000500)) 00:26:12 executing program 1: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5}}, @restrict]}}, &(0x7f0000000180)=""/174, 0x3e, 0xae, 0x1}, 0x20) [ 603.083514][T14278] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:13 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f00000002c0)={&(0x7f0000000000)=@can, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/224, 0xe0}, 0x40012002) close(r1) 00:26:13 executing program 1: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x4, &(0x7f00000000c0), 0x4) 00:26:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf000000}, 0x0) 00:26:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000a00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:13 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:13 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:13 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000002600)={&(0x7f0000000000)=@in={0x10, 0x2}, 0x10, 0x0}, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x28, &(0x7f0000000280)={0x1, [0x0]}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x13, &(0x7f0000000340)={r2}, 0x8) 00:26:13 executing program 3: r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x28, &(0x7f0000000280)={0x1, [0x0]}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x13, &(0x7f0000000340)={r2}, 0x8) [ 603.752244][T14292] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:13 executing program 1: syz_emit_ethernet(0x154b, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd62945ad615152ffffc010000000000000000000000000001fe8000000000000000000000000000aa"], 0x0) 00:26:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x10000000}, 0x0) 00:26:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000c00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:13 executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) listen(r0, 0x0) connect$inet(r0, &(0x7f0000000080)={0x10, 0x2}, 0x10) 00:26:13 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@volatile={0xd}]}}, &(0x7f0000000180)=""/142, 0x26, 0x8e, 0x1}, 0x20) [ 603.941656][T14304] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000e00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x26030000}, 0x0) 00:26:13 executing program 1: syz_emit_ethernet(0x508, &(0x7f00000009c0)=ANY=[@ANYBLOB="af52fc97bf905448e191c27486dd672a22fe04d211"], 0x0) [ 604.129925][T14311] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:14 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000f00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:14 executing program 3: r0 = socket$inet6_sctp(0x1c, 0x5, 0x84) connect$inet6(r0, &(0x7f0000000000)={0x1c, 0x1c, 0x1}, 0x1c) sendto$inet6(r0, &(0x7f0000000340)='0', 0x1, 0x0, &(0x7f0000000380)={0x1c, 0x1c, 0x1}, 0x1c) 00:26:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x60000000}, 0x0) 00:26:14 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:14 executing program 1: syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @random="f3223851686a", @val, {@ipv6}}, 0x0) 00:26:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x65580000}, 0x0) [ 604.776627][T14326] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:14 executing program 1: r0 = socket$inet_udplite(0x2, 0x2, 0x88) sendto$inet(r0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)={0x10, 0x2}, 0x10) 00:26:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f001000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:14 executing program 3: pwritev(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f00000006c0), 0x100000}], 0x1, 0x0, 0x0) r0 = socket(0x2, 0x5, 0x0) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x32, &(0x7f0000000080), 0x8) connect$inet(r0, &(0x7f00000000c0)={0x10}, 0x10) 00:26:14 executing program 1: r0 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x2, &(0x7f0000000040), 0x14) 00:26:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x81000000}, 0x0) 00:26:15 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$sock_linger(r0, 0xffff, 0x80, &(0x7f0000000180), 0x8) 00:26:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f004800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:15 executing program 1: syz_emit_ethernet(0x42, &(0x7f0000000080)={@broadcast, @broadcast, @val, {@ipv4}}, 0x0) 00:26:15 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:15 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x88a8ffff}, 0x0) 00:26:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f004c00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:15 executing program 1: syz_emit_ethernet(0x3a, &(0x7f0000000080)={@local, @random="d05b7b91efed", @val, {@ipv4}}, 0x0) 00:26:15 executing program 3: r0 = socket$inet(0x2, 0x3, 0x0) setsockopt$inet_opts(r0, 0x0, 0x1, &(0x7f0000000180)="c8", 0x1) 00:26:15 executing program 1: r0 = socket$inet(0x2, 0x3, 0x0) getsockopt$sock_int(r0, 0xffff, 0x1008, &(0x7f0000000000), &(0x7f0000000040)=0x4) 00:26:15 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x9effffff}, 0x0) 00:26:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006000ba8000001201", 0x2e}], 0x1}, 0x0) [ 606.031913][ T28] kauditd_printk_skb: 26 callbacks suppressed [ 606.031930][ T28] audit: type=1804 audit(1704327975.683:1741): pid=14372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/743/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 [ 606.154326][ T28] audit: type=1804 audit(1704327975.753:1742): pid=14367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/221/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 606.225519][ T28] audit: type=1804 audit(1704327975.763:1743): pid=14367 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/221/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:26:16 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf0ffffff}, 0x0) 00:26:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006800ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:16 executing program 1: bpf$BPF_BTF_LOAD(0x11, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x20) 00:26:16 executing program 3: r0 = socket$inet(0x2, 0x3, 0x0) getsockopt(r0, 0x100, 0x0, 0x0, 0x0) 00:26:16 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xffffa888}, 0x0) 00:26:16 executing program 1: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000026c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg(r0, 0x0, 0x0) 00:26:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006c00ba8000001201", 0x2e}], 0x1}, 0x0) [ 606.634322][ T28] audit: type=1804 audit(1704327976.283:1744): pid=14386 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/744/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 606.741119][ T28] audit: type=1804 audit(1704327976.393:1745): pid=14389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/222/cgroup.controllers" dev="sda1" ino=1979 res=1 errno=0 00:26:16 executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000540), 0x40a80, 0x0) [ 606.804214][T14398] validate_nla: 5 callbacks suppressed [ 606.804231][T14398] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f007400ba8000001201", 0x2e}], 0x1}, 0x0) [ 606.848773][ T28] audit: type=1804 audit(1704327976.393:1746): pid=14389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/222/cgroup.controllers" dev="sda1" ino=1979 res=1 errno=0 00:26:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xfffff000}, 0x0) [ 606.923834][ T28] audit: type=1804 audit(1704327976.503:1747): pid=14395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/745/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 [ 607.018132][T14405] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 607.048615][ T28] audit: type=1804 audit(1704327976.693:1748): pid=14408 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/746/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 607.125454][ T28] audit: type=1804 audit(1704327976.773:1749): pid=14403 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/203/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 607.153606][ T28] audit: type=1804 audit(1704327976.773:1750): pid=14403 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/203/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:26:17 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:17 executing program 3: bpf$BPF_BTF_LOAD(0xc, &(0x7f00000022c0)={0x0, 0x0, 0x0, 0x0, 0x1}, 0x20) 00:26:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f007a00ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:17 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x11, 0xf, &(0x7f0000000480)=@ringbuf, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000019c0), 0x8}, 0x90) 00:26:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xffffff7f}, 0x0) 00:26:17 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:17 executing program 1: bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0x1}, 0x48) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002600)={0x0, 0x0, 0x0}, 0x0) socketpair(0x0, 0x0, 0x0, &(0x7f0000002b40)) 00:26:17 executing program 3: r0 = socket$rds(0x15, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8912, &(0x7f0000000240)) [ 607.820485][T14415] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xffffff9e}, 0x0) 00:26:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00f000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:17 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETVNETLE(r0, 0x400454dc, 0x0) 00:26:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xfffffff0}, 0x0) [ 607.993694][T14430] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:18 executing program 3: socketpair(0x2b, 0x0, 0x1, &(0x7f0000000340)) 00:26:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f002101ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:18 executing program 1: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000200)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x4}, 0x90) 00:26:18 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x40030000000000}, 0x0) 00:26:18 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 608.515820][T14440] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:18 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:18 executing program 3: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000180)='syzkaller\x00'}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={r0, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000140)=[0x0], &(0x7f00000002c0)=[0x0], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) 00:26:18 executing program 1: bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=@bloom_filter={0x1e, 0x0, 0xb4b, 0x1f, 0x0, 0x1}, 0x48) 00:26:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000003ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:18 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf0ffffffffffff}, 0x0) 00:26:18 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000005bc0)={0x11, 0xb, &(0x7f0000005c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080005300000000faff0000940000000fad413e550000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000000c0)='tcp_retransmit_synack\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) 00:26:18 executing program 3: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFINDEX(r0, 0x541b, 0x0) [ 608.744460][T14452] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000005ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:18 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x100000000000000}, 0x0) 00:26:18 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000001800)=@base={0x0, 0x5, 0x9}, 0x48) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000001f40)) [ 608.899767][T14461] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000006ba8000001201", 0x2e}], 0x1}, 0x0) [ 609.084942][T14469] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:19 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:19 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x200000000000000}, 0x0) 00:26:19 executing program 3: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000580)={&(0x7f00000003c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x4}]}]}}, &(0x7f0000000480)=""/241, 0x32, 0xf1, 0x1}, 0x20) 00:26:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000007ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:19 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:19 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x300000000000000}, 0x0) [ 609.619595][T14477] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:19 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0xd41, &(0x7f0000000200)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xd33, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xd1f, 0x0, @gue={{0x2}, "58e5fd2abe89adc35e1a442e56f32e2d25458309b28b6853ee597e7c973e9f51322f9525b62383888cb83cf196f9a6b29c00c8b13add86d2eae6cfa31006e621dfae42b1dec09c0299d0b9b55cde339c43efe9b7183dde7fa88ccff33a88de5c4a195946309ac625a1807e776ff2df95135f574d855cb45f3e15c623229c8bd2a042032a733a0c972e90d072af091e3084abc8f1169b3f6fecbeaad721ca7463facc975b3ec0c64ed3b2f4c9f57b52565595e63580445911edbc9404f5e105e82a7dc9638eef86c561d802a7941f8417f56feae006ef2a8a6d5ec439e7581fe5e9df43e9aab2e023aa3b72035c6889880ced034fea2ba5363afe598e724ccd560e6b27109d9037ccb06438da3ca533c5233c76cf1037bc25ffcabca279a1a7aa62d3d2e326c52f0a10d08617bc0a21984784a48651802a60c8f553751547dbf95c5c9aed31c55785d9ceb4abcd7e1138e800ed18d127c563362b28371af0e4584d227e1562ccc7cb19c1efeaff845c6c1f94992da17e211cc8b4a1c670c97115bc4e75f5112660a679c6bac377922ee675c8ee553020f7851cca43e045fc56ac258393aaf5fab7bb4e5eb7fda6d2cb24643a13036b15911485fb91272ca14e45832ab1f8a87cbfe8d4bcaf6e23950741ca2e4442e1413cdf14ca4475668e1296ce134fe8ab892abbac55f973d4c847cb39bb4841cb3bb9112d1e7448a3e04167aa75d0a8de8f0f7dcd8ac95df3fee314b7caeb8e4ceb2bbc94b9232fe72dd27f385a67a13c97180f9ce0f8ec83d4d277c94231ab10b60a3a226141c49bbaccb54dd57736ba94551e64c380885717d65fe49d599814cec9c2ff69692890f916691ee52baba27feb247e7a5a7e2b481d099ed02c31a1ca1fb624983d86289ed68f9cb5ba50512407add504a637bf167c0e158500b0d298f94a8c496acbc95eb40d94b779cc15cd239155d6809fbe78989a9c0e3babe8d47a60471d52f285852f153ebe81449d313b3395037200190c3761a5db7836555cdbfefe9be0d10bae68a884ce59b87dedd96b6fe43df37e84be974197056683eaf81779562c1b3d492c4198d1178601928a8cc321e869c4f63797fc91ab51ec37a1fc3a618fbe3ef9e70d92802e797ed2b08c959761b74e6b45c8ee233a6d906621866d601ae044a2babb560d2cdb5df0dab47694659e2d2443d8a2512462625fcb8f1cbd51f2d4246ee5ca0badf7294b9b79263843a6cdc3bf3aa594b43be35ea4eaee3a1dd320d2f27fdd70b452f6d0d52f86abb0fa9149361e13403c0cd17b85cfa32879bc7f9b10d96baf723175291dd21940f53749db979c0e82d04af4db3059bc7d0d9a8fa2d1e5bd1a249e77af9f942137075177e1f24eaad8ec22c3be4e03e737cae2ca8b21f4b01ad0895cb50255c4b85e58643995de7072238ad97473f535b2c483f0d531e31bd442fb613ba647763153d2ed086e917cacd4829c92a70f885448140b123cbbc2ad8a53cdac2075b9e9d0b354463ab13cd6c210bbbab2c457d90cc745610114db3d0be6f6bb22cedb67d3efa98b6ef3779f4ef817170107d3eadd097f6e8cee4e73fa02f171dd991ae51b44f0b73925b0b69af9e254082f334a672bd4a043f8940d36f1d2fc6d40cbe627a0a7f34abbc20e1bc409000bf791c86f4bb45dfe84f48a77f7a02699e99323b0d0d456faf476c44886003eec1d3b836985316044b5813a2e72c9dfffafd316fc39e3adac6fb6e94cc6689765c42d5ebe2ff04e708f0465283d47ca6c23078e6e89f946993779b0caa22256008f9e2f8328b618472a96ea3f3857fc06c9ccb65282fc8870cdf2567f2acfdb9bed64c824d9581c1eac4ffdf171b3d7c53c12fa5562204274e1963ae4dfb0a9aa1e1099bbdc62bdeebf7f968e40fd942521a995cd8b4c04f943abe1a38fd0efd29b2507821138d5cd06c48e254f8aa1a3c528bb54a1ffb606897ff9c4e63a926e17fba9a35a3dd7c5cba6df2f18cc93e19dc79401b6971968311bcf7ac757f482dba1e6c76c4262aea1c8eeea79b5e4b5818cf6669c70f836a1d518edd9576cb6b6a7e41585f5423bc50023bc71d19bb813557f293749f09aea4a367512d06ecaedeaf1e91d0bd62d89e06a3c42973ec7ec6fdd584f78266d84cf4171f9b8cc9a0f4c814aee24091f04e7ebe140cc3f2819cf9366cd034eb556ad663434148855c246d951e224cd6e2de817f4f7da6f70bd246b1a9bbb4b6bc9843b20b42f01daad74dcdd1fed423624fc66c44195b3fe6fd76ff11f16f89b5e32a32068b5718a5bd46d18bd617de71418eddc05cb763648cd79da701aa66649b39811c1e132b02b1a71d05fb43b72c836094d92925b082801cb5df8a0788902a269efead37e583876d45c4718982d446f27b5718279c25e4274d570f8b055264017e60190b6eb886c6900e60bfde68515d01bde4b3405d09bc229063c2e68eb7c9a1c9ec5dacbeb5dbdabfdd78ce92ff88027480e3eaf96d4119191105691ef97fc2f4642a23558b4df290dad77aa610f4738122052b62d33fd521e441ffe95c92f71e27eb95c649d3919982d48033790dcd8fe14133729d94313348fd13d241734dd5d8e3f339d1be39a0aea2cda702ead79687f9c25e23be366d6658779b0d4c709e69795429d9e5a98a8385d22324872dc7864bb3a561226ef1545d14bda6b9817ace167649a11f152338c3853b647a40ac499a76fc3266fd4f0a2281c08031be9fd3c3d7919c2bda8bfb58e38089931a9ed7ef9a001ce4360a84b12dcd92513b786605515e765c4850e45c5b71ab5666671a2347c1443c00bff9d1186657fd9b65671b94c017a3f1d67de02fa0ecaabb3e832a67792805e74421740be04ff73477f3d9119507c9c7ed4f3bff85ade8275e42af724c24f1b7c9a05e4198079fc208f7fd6085d12488247617fe5ffb985a0437d37ccb2e4c6706289c8334e6d06efa96ddf01211ac2611f0abc5a1d8f5376749c562ca37b7432133157b0aab1a0a631341aab716486d18be0858b609bb607d626c0af113005279bf6edb4d0987da6f000ba7d8130630814e3b3fe33f1608ff21b512489062c8c0d7ef802d8f168583ac67354e3a0038ec233d94c186fc85c7eb03aad5188b4ddbeb750ed6bacb9995e5e0955756ee700c1263326f4c6021883fd979ee2604035a0b4ac0f6ab3c62748a4526096861320bf3b0fdabd6fcc6c49b179e24ecdd737bde067049c77ba9687678adfed67dca68dda45842e2cb4e4caf800ef5bc5510c768449e53971c583069b167f902b4f018797eb692e5095db6bc385a7a4203b4fbe76c96b619ad523651d4922296f8fc447ef72f82bce944ffde71c75d633ac5471759cacf219be9ab817d2aee183a582df8bdcb8bff1e9b2c684eb47de6eb6a516abdf1a548f0d98868f83244c4a4a9d55e4fa2445ad717cbb0437e356c5439898e520d81667cebe1e314fef406ca136773a586831856bd0d8d6ec5690c606daf449ad8920e079aff414f2d84bab215c151cda8236dd8832fe19985f679b5efc4692710d928cdeaef9ea6232afd4b373c1d80862570ebd8bc0ef131687065b04c3e75818ded858caa8872b93a40b7597ec4c18709dcd21a71581088bae31c785f19fb71eaa41e43b451f0ee754204b5f523c3b649b9fd837253b172bc351374e9e991d51e80807eb4c25108621e33da32ec070d8360d4dbe560c94dca287e4d1dc88ad76f79e16138c8f016df272b18048306ef78b748fa3c4b03b94fefcff3f87c3a55d32bb1179319d8d485927f0fe069590ded4d9305016bd5b350813bbac261e1748914b9c1aea9a0559fe192662a255403e6769dd435a745df36bb49fb567ceea031ad12c9d05f2825ebb179792ba79d50d25d6e74fd5b4c3040950d3bd5303d0ab1bb4847832b8961a8fcba472dff991a5fff31cd0ca4b0eeb38db61c1f1badbe154bf67f7513444f6b68a941d389d337187a635d67ae3347c1c58e8334e3d3a831c57667f051ed67dfa953288ab25c6abe4ad5a6739ddbef1489555eb14fe4ca51761c720db789caeb2d772f689ae74dbc1b574519cc6075e53f91afb8395c50c50f0a4d526e0ec82437e2e71ac210cdba3ab83e00c8c7e5c32437e28049216a76950f7953edb30ccbf4dfe87d6732dd3aec7977d3cb64431689577af74d001f278a9fd966d5fe084a597d8039b98164317269b9a020710dc8caa6e97d83f0132572603965a2c233f7610367e404486aaf40384f321f03a61cc72bcad3d9994299d326f6ddf58d8104f53ee29a14e2715588c313f7d6a9ceddfd2633d58ffd2a70ccdb23a021a3a4f58da12d8fb4a220c66bf8f3fcd3d8bd5bdbd658967e5265451005529ea6dbb80283db5fd4f28c07161a58964989e7e3e195891781b1d325837c35c54519b0f6ec5fc0817c41d61a3b4d4ec8710ef8f23b40ddc35dde1c652b3197f1cd8c859ac69c89107479c0662da7197b9562e6c9bb40b032010633fb71d87e7c8001b74d37d7ea3d16440f6b14641881dd15606f31df69c9d20f4c515dcb5b2e3a24d3d6614a639a570e5a93700c66853a3023c820c8969b48b490f0de12e3a27290374024e3d2ab6c846368ca7e7cac84695c0213b754fbe42e5a1b866067cb690ae399388bd70c243ce786803ce82852a3a8ee1230aff1447b997b961f4a71bda82c39a0705350692993e3a11ea110caf600da503f78f7aa6e64e3d"}}}}}}, 0x0) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:26:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000009ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:19 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000005bc0)={0x11, 0xb, &(0x7f0000005c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080005300000000faff0000940000000fad413e550000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000000c0)='tcp_retransmit_synack\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) 00:26:19 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x400000000000000}, 0x0) 00:26:19 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000aba8000001201", 0x2e}], 0x1}, 0x0) [ 609.904342][T14487] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:19 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x600000000000000}, 0x0) 00:26:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f009e0bba8000001201", 0x2e}], 0x1}, 0x0) 00:26:20 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x700000000000000}, 0x0) 00:26:20 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:20 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:20 executing program 3: bpf$MAP_CREATE_RINGBUF(0x1d, &(0x7f0000000ec0), 0x48) 00:26:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f009f0bba8000001201", 0x2e}], 0x1}, 0x0) 00:26:20 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x800000000000000}, 0x0) 00:26:20 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000005bc0)={0x11, 0xb, &(0x7f0000005c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080005300000000faff0000940000000fad413e550000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000000c0)='tcp_retransmit_synack\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) 00:26:20 executing program 3: syz_emit_ethernet(0xfdef, &(0x7f0000001500)={@local, @multicast, @val, {@ipv6={0x86dd, @tipc_packet={0x0, 0x6, "4c0217", 0x20, 0x29, 0x0, @dev, @mcast2, {[], @payload_direct={{{{0x20, 0x0, 0x0, 0x0, 0x0, 0x8}}}}}}}}}, 0x0) 00:26:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00a00bba8000001201", 0x2e}], 0x1}, 0x0) 00:26:20 executing program 3: bpf$MAP_CREATE(0x18, &(0x7f0000000080)=@base={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x48) 00:26:20 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xa00000000000000}, 0x0) 00:26:20 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00a10bba8000001201", 0x2e}], 0x1}, 0x0) 00:26:20 executing program 3: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r0, 0x6, 0x4, 0x0, &(0x7f0000000100)) [ 611.225671][ T28] kauditd_printk_skb: 28 callbacks suppressed [ 611.225685][ T28] audit: type=1804 audit(1704327980.873:1779): pid=14521 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/759/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 00:26:21 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:21 executing program 3: bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@bloom_filter, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@bloom_filter, 0x8b) 00:26:21 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xc00000000000000}, 0x0) 00:26:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000cba8000001201", 0x2e}], 0x1}, 0x0) 00:26:21 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 611.775641][ T28] audit: type=1804 audit(1704327981.423:1780): pid=14531 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/760/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 00:26:21 executing program 1: r0 = bpf$PROG_LOAD(0x5, &(0x7f0000005bc0)={0x11, 0xb, &(0x7f0000005c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='sched_switch\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000080005300000000faff0000940000000fad413e550000000f00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000000c0)='tcp_retransmit_synack\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) 00:26:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000eba8000001201", 0x2e}], 0x1}, 0x0) 00:26:21 executing program 3: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r0, 0x6, 0x22, 0x0, &(0x7f0000000100)) 00:26:21 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xe00000000000000}, 0x0) [ 611.941643][ T28] audit: type=1804 audit(1704327981.593:1781): pid=14532 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/227/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 612.030843][ T28] audit: type=1804 audit(1704327981.623:1782): pid=14532 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/227/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 612.035745][T14541] validate_nla: 6 callbacks suppressed [ 612.035762][T14541] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:21 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf00000000000000}, 0x0) [ 612.071005][ T28] audit: type=1804 audit(1704327981.663:1783): pid=14536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/208/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 00:26:21 executing program 3: r0 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r0, 0x6, 0x10, 0x0, &(0x7f0000000100)) 00:26:21 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000fba8000001201", 0x2e}], 0x1}, 0x0) [ 612.153254][ T28] audit: type=1804 audit(1704327981.673:1784): pid=14536 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/208/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 [ 612.279477][ T28] audit: type=1804 audit(1704327981.713:1785): pid=14542 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/761/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 612.361923][ T28] audit: type=1804 audit(1704327981.863:1786): pid=14547 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/762/cgroup.controllers" dev="sda1" ino=1968 res=1 errno=0 [ 612.379914][T14551] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:22 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:22 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x1000000000000000}, 0x0) 00:26:22 executing program 3: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000003040), 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, r0}, 0x38) 00:26:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00001fba8000001201", 0x2e}], 0x1}, 0x0) [ 612.697902][T14556] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 612.730381][ T28] audit: type=1804 audit(1704327982.383:1787): pid=14555 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/763/cgroup.controllers" dev="sda1" ino=1969 res=1 errno=0 00:26:22 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000020ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:22 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = accept4$inet6(r1, 0x0, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000940)="ff", 0xfffffdef, 0x15400, 0x0, 0x1802) sendmsg$inet(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="e2", 0x10002}], 0x1}, 0x0) 00:26:22 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x2603000000000000}, 0x0) 00:26:22 executing program 1: syz_emit_ethernet(0x2a, &(0x7f0000000440)={@link_local, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x7, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x0, 0x8}}}}}, 0x0) [ 613.056554][ T28] audit: type=1804 audit(1704327982.703:1788): pid=14559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/228/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:26:22 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6000000000000000}, 0x0) 00:26:22 executing program 1: syz_emit_ethernet(0xfdef, &(0x7f0000000440)={@link_local, @local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x800e, 0x0, 0x11, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x0, 0x8}}}}}, 0x0) 00:26:22 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000121ba8000001201", 0x2e}], 0x1}, 0x0) [ 613.104234][T14572] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 613.258695][T14578] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:23 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:23 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x6558000000000000}, 0x0) 00:26:23 executing program 1: socket(0x2, 0x3, 0x8) 00:26:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00003fba8000001201", 0x2e}], 0x1}, 0x0) 00:26:23 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:23 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 613.827922][T14583] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:23 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000048ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:23 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x8100000000000000}, 0x0) [ 614.006007][T14592] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00004cba8000001201", 0x2e}], 0x1}, 0x0) 00:26:23 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x88a8ffff00000000}, 0x0) [ 614.170179][T14603] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:23 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f006558ba8000001201", 0x2e}], 0x1}, 0x0) [ 614.355613][T14608] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:24 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:24 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x9effffff00000000}, 0x0) 00:26:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000060ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:24 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 614.908584][T14612] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:24 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:24 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xf0ffffff00000000}, 0x0) 00:26:24 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x600000000000000}, 0x0) 00:26:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f005865ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:24 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xffffff7f00000000}, 0x0) 00:26:24 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000068ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:24 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0xfffffffffffff000}, 0x0) 00:26:24 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00006cba8000001201", 0x2e}], 0x1}, 0x0) 00:26:25 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x2}, 0x0) 00:26:25 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:25 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x100000000000000}, 0x0) 00:26:25 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:25 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x3}, 0x0) 00:26:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000074ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:25 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00007aba8000001201", 0x2e}], 0x1}, 0x0) 00:26:25 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x4}, 0x0) [ 616.265085][ T28] kauditd_printk_skb: 33 callbacks suppressed [ 616.265103][ T28] audit: type=1804 audit(1704327985.913:1822): pid=14650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/404/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 00:26:26 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:26 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6}, 0x0) [ 616.364447][ T28] audit: type=1804 audit(1704327985.993:1823): pid=14655 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/775/cgroup.controllers" dev="sda1" ino=1961 res=1 errno=0 00:26:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000081ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:26 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 616.460232][ T28] audit: type=1804 audit(1704327986.043:1824): pid=14651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/212/cgroup.controllers" dev="sda1" ino=1981 res=1 errno=0 00:26:26 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x7}, 0x0) [ 616.571171][ T28] audit: type=1804 audit(1704327986.063:1825): pid=14651 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/212/cgroup.controllers" dev="sda1" ino=1981 res=1 errno=0 [ 616.693142][ T28] audit: type=1804 audit(1704327986.163:1826): pid=14660 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/776/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 [ 616.775032][ T28] audit: type=1804 audit(1704327986.353:1827): pid=14666 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/777/cgroup.controllers" dev="sda1" ino=1948 res=1 errno=0 [ 616.875408][ T28] audit: type=1804 audit(1704327986.493:1828): pid=14661 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/405/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 00:26:26 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000b9eba8000001201", 0x2e}], 0x1}, 0x0) [ 616.966633][ T28] audit: type=1804 audit(1704327986.503:1829): pid=14661 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/405/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 [ 617.052132][T14671] validate_nla: 5 callbacks suppressed [ 617.052151][T14671] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 617.069822][ T28] audit: type=1804 audit(1704327986.723:1830): pid=14668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/630/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:26 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x8}, 0x0) 00:26:26 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:26 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000b9fba8000001201", 0x2e}], 0x1}, 0x0) [ 617.162529][ T28] audit: type=1804 audit(1704327986.763:1831): pid=14668 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/630/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:26 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xa}, 0x0) [ 617.341858][T14678] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000ba0ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:27 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:27 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xc}, 0x0) [ 617.547511][T14685] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000ba1ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:27 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xe}, 0x0) 00:26:27 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 617.759196][T14691] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:27 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f0000f0ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:27 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf}, 0x0) [ 618.105366][T14701] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:27 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x10}, 0x0) 00:26:27 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000002ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:27 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x60}, 0x0) [ 618.390020][T14708] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000003ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf0}, 0x0) 00:26:28 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 618.707131][T14716] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:28 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x300}, 0x0) 00:26:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000004ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x326}, 0x0) 00:26:28 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 619.111112][T14728] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:28 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x600}, 0x0) 00:26:28 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000005ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:29 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:29 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x700}, 0x0) [ 619.371168][T14736] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000006ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:29 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xa00}, 0x0) 00:26:29 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 619.773149][T14746] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:29 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x326}, 0x0) 00:26:29 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xc00}, 0x0) 00:26:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000007ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000008ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:29 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xe00}, 0x0) 00:26:29 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:29 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000009ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:30 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c2100080003", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf00}, 0x0) 00:26:30 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000aba8000001201", 0x2e}], 0x1}, 0x0) 00:26:30 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x2603}, 0x0) [ 620.769184][T14768] __nla_validate_parse: 278 callbacks suppressed [ 620.769204][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000cba8000001201", 0x2e}], 0x1}, 0x0) 00:26:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x5865}, 0x0) [ 620.838857][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 620.900443][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 620.933326][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6000}, 0x0) [ 621.005548][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:30 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000eba8000001201", 0x2e}], 0x1}, 0x0) [ 621.047606][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 621.070297][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 621.111200][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:30 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(0xffffffffffffffff, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:30 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6558}, 0x0) [ 621.151398][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 621.187926][T14768] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 621.329022][ T28] kauditd_printk_skb: 48 callbacks suppressed [ 621.329040][ T28] audit: type=1804 audit(1704327990.983:1880): pid=14790 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/797/cgroup.controllers" dev="sda1" ino=1966 res=1 errno=0 00:26:31 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00000fba8000001201", 0x2e}], 0x1}, 0x0) [ 621.444475][ T28] audit: type=1804 audit(1704327991.043:1881): pid=14782 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/409/cgroup.controllers" dev="sda1" ino=1981 res=1 errno=0 [ 621.504582][ T28] audit: type=1804 audit(1704327991.063:1882): pid=14782 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/409/cgroup.controllers" dev="sda1" ino=1981 res=1 errno=0 [ 621.598826][ T28] audit: type=1804 audit(1704327991.093:1883): pid=14792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/236/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 [ 621.676803][ T28] audit: type=1804 audit(1704327991.093:1884): pid=14792 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/236/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 [ 621.753520][ T28] audit: type=1804 audit(1704327991.403:1885): pid=14797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/635/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 [ 621.845114][ T28] audit: type=1804 audit(1704327991.403:1886): pid=14797 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/635/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000010ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:31 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x8100}, 0x0) 00:26:31 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:31 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:31 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:31 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000048ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:31 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf000}, 0x0) [ 622.038809][ T28] audit: type=1804 audit(1704327991.673:1887): pid=14802 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/798/cgroup.controllers" dev="sda1" ino=1965 res=1 errno=0 00:26:31 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 622.209963][T14815] validate_nla: 8 callbacks suppressed [ 622.209980][T14815] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 622.228789][ T28] audit: type=1804 audit(1704327991.863:1888): pid=14804 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/636/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:26:31 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x34000}, 0x0) 00:26:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00004cba8000001201", 0x2e}], 0x1}, 0x0) [ 622.308827][ T28] audit: type=1804 audit(1704327991.863:1889): pid=14816 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/799/cgroup.controllers" dev="sda1" ino=1983 res=1 errno=0 [ 622.450588][T14823] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x400300}, 0x0) 00:26:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000060ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf0ffff}, 0x0) [ 622.701939][T14828] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000068ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x1000000}, 0x0) 00:26:32 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x400300}, 0x0) [ 623.003192][T14833] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:32 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:32 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00006cba8000001201", 0x2e}], 0x1}, 0x0) [ 623.208713][T14840] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:32 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x2000000}, 0x0) 00:26:32 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0x0, 0x8, 0xe}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:32 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000074ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:32 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 623.347824][T14848] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:33 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f00007aba8000001201", 0x2e}], 0x1}, 0x0) 00:26:33 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x3000000}, 0x0) 00:26:33 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x4000000}, 0x0) [ 623.570209][T14862] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba0700001201", 0x2e}], 0x1}, 0x0) [ 623.794697][T14867] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:33 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6000000}, 0x0) 00:26:33 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8002001201", 0x2e}], 0x1}, 0x0) 00:26:33 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:33 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x7000000}, 0x0) 00:26:33 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:34 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, 0x0, 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 624.372322][T14874] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:34 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x8000000}, 0x0) 00:26:34 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8003001201", 0x2e}], 0x1}, 0x0) 00:26:34 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xa000000}, 0x0) [ 624.581555][T14886] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8004001201", 0x2e}], 0x1}, 0x0) 00:26:34 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xc000000}, 0x0) [ 624.722125][ T1226] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.729163][ T1226] ieee802154 phy1 wpan1: encryption failed: -22 00:26:34 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8005001201", 0x2e}], 0x1}, 0x0) 00:26:35 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xe000000}, 0x0) 00:26:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8006001201", 0x2e}], 0x1}, 0x0) 00:26:35 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:35 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8007001201", 0x2e}], 0x1}, 0x0) 00:26:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf000000}, 0x0) 00:26:35 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8008001201", 0x2e}], 0x1}, 0x0) 00:26:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x10000000}, 0x0) 00:26:35 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8009001201", 0x2e}], 0x1}, 0x0) 00:26:35 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x26030000}, 0x0) 00:26:36 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x60000000}, 0x0) 00:26:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800a001201", 0x2e}], 0x1}, 0x0) 00:26:36 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:36 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x65580000}, 0x0) [ 626.513698][ T28] kauditd_printk_skb: 49 callbacks suppressed [ 626.513714][ T28] audit: type=1804 audit(1704327996.163:1939): pid=14933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/816/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 00:26:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800c001201", 0x2e}], 0x1}, 0x0) [ 626.635232][ T28] audit: type=1804 audit(1704327996.233:1940): pid=14931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/221/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 626.676212][ T28] audit: type=1804 audit(1704327996.243:1941): pid=14931 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/221/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 [ 626.704464][ T28] audit: type=1804 audit(1704327996.303:1942): pid=14934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/241/cgroup.controllers" dev="sda1" ino=1983 res=1 errno=0 [ 626.731978][ T28] audit: type=1804 audit(1704327996.313:1943): pid=14934 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/241/cgroup.controllers" dev="sda1" ino=1983 res=1 errno=0 00:26:36 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800e001201", 0x2e}], 0x1}, 0x0) 00:26:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x81000000}, 0x0) [ 626.771662][ T28] audit: type=1804 audit(1704327996.363:1944): pid=14941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/817/cgroup.controllers" dev="sda1" ino=1980 res=1 errno=0 00:26:36 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800f001201", 0x2e}], 0x1}, 0x0) 00:26:36 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x88a8ffff}, 0x0) [ 626.940757][ T28] audit: type=1804 audit(1704327996.583:1945): pid=14947 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/818/cgroup.controllers" dev="sda1" ino=1965 res=1 errno=0 [ 627.041230][ T28] audit: type=1804 audit(1704327996.603:1946): pid=14940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/414/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 [ 627.155854][ T28] audit: type=1804 audit(1704327996.613:1947): pid=14940 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/414/cgroup.controllers" dev="sda1" ino=1982 res=1 errno=0 [ 627.229083][ T28] audit: type=1804 audit(1704327996.763:1948): pid=14954 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/819/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:26:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8010001201", 0x2e}], 0x1}, 0x0) 00:26:37 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:37 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x9effffff}, 0x0) 00:26:37 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:37 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:37 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf0ffffff}, 0x0) 00:26:37 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 627.688250][T14963] validate_nla: 10 callbacks suppressed [ 627.688268][T14963] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8048001201", 0x2e}], 0x1}, 0x0) 00:26:37 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xffffa888}, 0x0) [ 627.917420][T14974] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba804c001201", 0x2e}], 0x1}, 0x0) 00:26:37 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xfffff000}, 0x0) [ 628.129687][T14978] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:37 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8060001201", 0x2e}], 0x1}, 0x0) [ 628.371732][T14982] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:38 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:38 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xffffff7f}, 0x0) 00:26:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8068001201", 0x2e}], 0x1}, 0x0) 00:26:38 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:38 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:38 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xffffff9e}, 0x0) 00:26:38 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xffffff7f}, 0x0) [ 628.684008][T14990] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba806c001201", 0x2e}], 0x1}, 0x0) 00:26:38 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xfffffff0}, 0x0) 00:26:38 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 628.929368][T15001] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:38 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0), 0x0, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:38 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8074001201", 0x2e}], 0x1}, 0x0) [ 629.087894][T15008] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:39 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x40030000000000}, 0x0) 00:26:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba807a001201", 0x2e}], 0x1}, 0x0) 00:26:39 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:39 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:39 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee40802110000015050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80f0001201", 0x2e}], 0x1}, 0x0) [ 629.657524][T15015] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:39 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 00:26:39 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 629.850161][T15026] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8021011201", 0x2e}], 0x1}, 0x0) 00:26:39 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x100000000000000}, 0x0) [ 630.053835][T15032] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:39 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE={0xe}]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000031201", 0x2e}], 0x1}, 0x0) 00:26:39 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x200000000000000}, 0x0) 00:26:39 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000051201", 0x2e}], 0x1}, 0x0) 00:26:39 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e00d4000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000061201", 0x2e}], 0x1}, 0x0) 00:26:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x300000000000000}, 0x0) 00:26:40 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000071201", 0x2e}], 0x1}, 0x0) 00:26:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x400000000000000}, 0x0) 00:26:40 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52e"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:40 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x600000000000000}, 0x0) 00:26:40 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000091201", 0x2e}], 0x1}, 0x0) 00:26:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x700000000000000}, 0x0) 00:26:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000a1201", 0x2e}], 0x1}, 0x0) 00:26:41 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:41 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 631.542909][ T28] kauditd_printk_skb: 47 callbacks suppressed [ 631.542925][ T28] audit: type=1804 audit(1704328001.193:1996): pid=15078 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/834/cgroup.controllers" dev="sda1" ino=1973 res=1 errno=0 00:26:41 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev={0xfe, 0x80, '\x00', 0xc}}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x800000000000000}, 0x0) 00:26:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba809e0b1201", 0x2e}], 0x1}, 0x0) [ 631.728346][ T28] audit: type=1804 audit(1704328001.373:1997): pid=15082 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/230/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:41 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba809f0b1201", 0x2e}], 0x1}, 0x0) [ 631.825799][ T28] audit: type=1804 audit(1704328001.463:1998): pid=15082 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/230/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xa00000000000000}, 0x0) 00:26:41 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="480400", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 631.933046][ T28] audit: type=1804 audit(1704328001.543:1999): pid=15089 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/835/cgroup.controllers" dev="sda1" ino=1971 res=1 errno=0 00:26:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80a00b1201", 0x2e}], 0x1}, 0x0) [ 632.044763][ T28] audit: type=1804 audit(1704328001.683:2000): pid=15092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/648/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:41 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="4804", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:41 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xc00000000000000}, 0x0) [ 632.150053][ T28] audit: type=1804 audit(1704328001.723:2001): pid=15098 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/836/cgroup.controllers" dev="sda1" ino=1969 res=1 errno=0 00:26:41 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:41 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:41 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80a10b1201", 0x2e}], 0x1}, 0x0) [ 632.245390][ T28] audit: type=1804 audit(1704328001.843:2002): pid=15104 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/231/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 00:26:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xe00000000000000}, 0x0) [ 632.380943][ T28] audit: type=1804 audit(1704328001.843:2003): pid=15104 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/231/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 00:26:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000c1201", 0x2e}], 0x1}, 0x0) 00:26:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf00000000000000}, 0x0) [ 632.478518][ T28] audit: type=1804 audit(1704328001.973:2004): pid=15109 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/837/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 00:26:42 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:42 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 632.596155][ T28] audit: type=1804 audit(1704328002.123:2005): pid=15102 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/420/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:26:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000e1201", 0x2e}], 0x1}, 0x0) 00:26:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x1000000000000000}, 0x0) 00:26:42 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:42 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:42 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:42 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x2603000000000000}, 0x0) [ 633.134154][T15134] validate_nla: 11 callbacks suppressed [ 633.134171][T15134] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:42 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000f1201", 0x2e}], 0x1}, 0x0) 00:26:42 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6000000000000000}, 0x0) 00:26:43 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:43 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) [ 633.381055][T15148] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80001f1201", 0x2e}], 0x1}, 0x0) 00:26:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x6558000000000000}, 0x0) [ 633.550671][T15158] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000201201", 0x2e}], 0x1}, 0x0) [ 633.832321][T15164] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 633.863098][T15143] __nla_validate_parse: 150 callbacks suppressed [ 633.863119][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.896610][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.912236][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.924886][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.939773][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.952630][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.965949][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.980373][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 633.993721][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. [ 634.007568][T15143] netlink: 1068 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:43 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x8100000000000000}, 0x0) 00:26:43 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:43 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) 00:26:43 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8001211201", 0x2e}], 0x1}, 0x0) [ 634.189268][T15173] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:43 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x88a8ffff00000000}, 0x0) 00:26:43 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80003f1201", 0x2e}], 0x1}, 0x0) 00:26:44 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:44 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) 00:26:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 00:26:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000481201", 0x2e}], 0x1}, 0x0) [ 634.467360][T15184] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 634.636588][T15192] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:44 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80004c1201", 0x2e}], 0x1}, 0x0) 00:26:44 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 00:26:44 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:44 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:44 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:44 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 635.326245][T15201] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8065581201", 0x2e}], 0x1}, 0x0) 00:26:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 00:26:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 635.587421][T15213] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 00:26:45 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000601201", 0x2e}], 0x1}, 0x0) [ 635.879225][T15221] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:45 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8058651201", 0x2e}], 0x1}, 0x0) 00:26:45 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:45 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:45 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:45 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:45 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000681201", 0x2e}], 0x1}, 0x0) 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x2}, 0x0) 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80006c1201", 0x2e}], 0x1}, 0x0) 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x3}, 0x0) [ 636.550037][ T28] kauditd_printk_skb: 55 callbacks suppressed [ 636.550054][ T28] audit: type=1804 audit(1704328006.203:2061): pid=15243 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/851/cgroup.controllers" dev="sda1" ino=1980 res=1 errno=0 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000741201", 0x2e}], 0x1}, 0x0) 00:26:46 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:46 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) [ 636.735094][ T28] audit: type=1804 audit(1704328006.383:2062): pid=15234 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/424/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4}, 0x0) 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80007a1201", 0x2e}], 0x1}, 0x0) [ 636.853110][ T28] audit: type=1804 audit(1704328006.403:2063): pid=15234 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/424/cgroup.controllers" dev="sda1" ino=1976 res=1 errno=0 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x6}, 0x0) [ 636.943053][ T28] audit: type=1804 audit(1704328006.413:2064): pid=15248 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/852/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 00:26:46 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r3, r2, 0x0, 0x10000a006) 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000811201", 0x2e}], 0x1}, 0x0) 00:26:46 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:46 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 637.048553][ T28] audit: type=1804 audit(1704328006.433:2065): pid=15239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/653/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x7}, 0x0) 00:26:46 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800b9e1201", 0x2e}], 0x1}, 0x0) [ 637.164118][ T28] audit: type=1804 audit(1704328006.443:2066): pid=15239 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.3" name="/root/syzkaller-testdir2764517254/syzkaller.b1RlJZ/653/cgroup.controllers" dev="sda1" ino=1978 res=1 errno=0 00:26:46 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:26:46 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x8}, 0x0) 00:26:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800b9f1201", 0x2e}], 0x1}, 0x0) [ 637.279354][ T28] audit: type=1804 audit(1704328006.573:2067): pid=15257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/853/cgroup.controllers" dev="sda1" ino=1984 res=1 errno=0 [ 637.379554][ T28] audit: type=1804 audit(1704328006.653:2068): pid=15252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/256/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 00:26:47 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) 00:26:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800ba01201", 0x2e}], 0x1}, 0x0) [ 637.455380][ T28] audit: type=1804 audit(1704328006.663:2069): pid=15252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/256/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 00:26:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xa}, 0x0) [ 637.540059][ T28] audit: type=1804 audit(1704328006.733:2070): pid=15254 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/241/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:26:47 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r3, r2, 0x0, 0x10000a006) 00:26:47 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) 00:26:47 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800ba11201", 0x2e}], 0x1}, 0x0) 00:26:47 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:26:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xc}, 0x0) 00:26:47 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000f01201", 0x2e}], 0x1}, 0x0) 00:26:47 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xe}, 0x0) [ 638.252131][T15304] validate_nla: 10 callbacks suppressed [ 638.252150][T15304] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf}, 0x0) 00:26:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000021201", 0x2e}], 0x1}, 0x0) 00:26:48 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(0xffffffffffffffff, r4, 0x0, 0x10000a006) [ 638.462793][T15314] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x10}, 0x0) 00:26:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000031201", 0x2e}], 0x1}, 0x0) 00:26:48 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x4, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x60}, 0x0) 00:26:48 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:48 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x3, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:48 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, 0x0}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r3, r2, 0x0, 0x10000a006) [ 639.204669][T15324] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:48 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 00:26:48 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000041201", 0x2e}], 0x1}, 0x0) 00:26:48 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e07}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x300}, 0x0) 00:26:49 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) [ 639.438482][T15341] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000051201", 0x2e}], 0x1}, 0x0) 00:26:49 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x326}, 0x0) [ 639.668955][T15349] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x600}, 0x0) 00:26:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000061201", 0x2e}], 0x1}, 0x0) [ 639.926700][T15359] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x700}, 0x0) 00:26:49 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000071201", 0x2e}], 0x1}, 0x0) 00:26:49 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, 0xffffffffffffffff, 0x0, 0x10000a006) 00:26:49 executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c21000800", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:49 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xa00}, 0x0) [ 640.302384][T15365] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:50 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r4, r3, 0x0, 0x10000a006) 00:26:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000081201", 0x2e}], 0x1}, 0x0) 00:26:50 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xc00}, 0x0) 00:26:50 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) [ 640.602320][T15374] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000091201", 0x2e}], 0x1}, 0x0) [ 640.648897][T15368] netlink: 'syz-executor.3': attribute type 72 has an invalid length. [ 640.665373][T15368] __nla_validate_parse: 240 callbacks suppressed [ 640.665389][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xe00}, 0x0) [ 640.743865][T15368] netlink: 'syz-executor.3': attribute type 72 has an invalid length. [ 640.769241][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. [ 640.813484][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000a1201", 0x2e}], 0x1}, 0x0) [ 640.858729][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf00}, 0x0) [ 640.900692][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. [ 640.950694][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:50 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000c1201", 0x2e}], 0x1}, 0x0) [ 641.001634][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. [ 641.074662][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. [ 641.148738][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. [ 641.203365][T15368] netlink: 1016 bytes leftover after parsing attributes in process `syz-executor.3'. 00:26:50 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) 00:26:50 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x2603}, 0x0) 00:26:51 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'bridge0\x00'}) 00:26:51 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) [ 641.857092][ T28] kauditd_printk_skb: 63 callbacks suppressed [ 641.857110][ T28] audit: type=1804 audit(1704328011.503:2134): pid=15403 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/265/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 [ 641.920151][ T28] audit: type=1804 audit(1704328011.513:2135): pid=15403 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/265/cgroup.controllers" dev="sda1" ino=1951 res=1 errno=0 00:26:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'bridge0\x00'}) socket$netlink(0x10, 0x3, 0x0) 00:26:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000e1201", 0x2e}], 0x1}, 0x0) 00:26:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x5865}, 0x0) 00:26:51 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) socket$inet_udplite(0x2, 0x2, 0x88) 00:26:51 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x0) 00:26:51 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'bridge0\x00'}) 00:26:51 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000f1201", 0x2e}], 0x1}, 0x0) [ 642.217039][ T28] audit: type=1804 audit(1704328011.863:2136): pid=15416 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/873/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 00:26:51 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x6000}, 0x0) 00:26:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000101201", 0x2e}], 0x1}, 0x0) 00:26:52 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:52 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00'}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'bridge0\x00'}) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r5}) [ 642.416209][ T28] audit: type=1804 audit(1704328012.063:2137): pid=15419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/266/cgroup.controllers" dev="sda1" ino=1980 res=1 errno=0 00:26:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000481201", 0x2e}], 0x1}, 0x0) [ 642.526614][ T28] audit: type=1804 audit(1704328012.083:2138): pid=15419 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/266/cgroup.controllers" dev="sda1" ino=1980 res=1 errno=0 [ 642.669035][ T28] audit: type=1804 audit(1704328012.163:2139): pid=15424 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/874/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 00:26:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) 00:26:52 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x6558}, 0x0) 00:26:52 executing program 2: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0xffffffff, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) 00:26:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80004c1201", 0x2e}], 0x1}, 0x0) 00:26:52 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) socket$igmp(0x2, 0x3, 0x2) 00:26:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000601201", 0x2e}], 0x1}, 0x0) [ 642.989656][ T28] audit: type=1804 audit(1704328012.633:2140): pid=15438 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.2" name="/root/syzkaller-testdir1910092784/syzkaller.lLMgWI/267/cgroup.controllers" dev="sda1" ino=1964 res=1 errno=0 00:26:52 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) r9 = socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x541b, 0x0) 00:26:52 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:52 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x8100}, 0x0) 00:26:52 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000681201", 0x2e}], 0x1}, 0x0) [ 643.120170][ T28] audit: type=1804 audit(1704328012.693:2141): pid=15445 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/875/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:26:52 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 643.269618][ T28] audit: type=1804 audit(1704328012.913:2142): pid=15455 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/876/cgroup.controllers" dev="sda1" ino=1958 res=1 errno=0 [ 643.309701][T15456] validate_nla: 20 callbacks suppressed [ 643.309721][T15456] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) r9 = socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x541b, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r9, 0x80089419, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) 00:26:53 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) r9 = socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x541b, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r9, 0x80089419, &(0x7f0000000040)) 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf000}, 0x0) 00:26:53 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80006c1201", 0x2e}], 0x1}, 0x0) [ 643.457895][ T28] audit: type=1804 audit(1704328013.103:2143): pid=15463 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/877/cgroup.controllers" dev="sda1" ino=1966 res=1 errno=0 [ 643.499975][T15467] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x34000}, 0x0) 00:26:53 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) r9 = socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x541b, 0x0) 00:26:53 executing program 3: sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000741201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x400300}, 0x0) 00:26:53 executing program 3: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 643.710242][T15476] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee2446e405c4cfac99f923a15d274580076f9724d94550e24bfb507dcbc7fbf4bff419b9c02f92438bf0b3a9d8d25c25c7b37a875840295445f0ab051b49d5e43fe319400fdea5b78846"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80007a1201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000634000/0x1000)=nil, 0x1000, 0x0, 0x110, r3, 0x6cd7d000) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x541b, 0x0) sendfile(r0, r5, 0x0, 0x800000000000005) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, 0x7, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3ff}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x60}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x8080}, 0x800) 00:26:53 executing program 2: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000002c0)) ioctl$SIOCRSSCAUSE(r0, 0x89e1, &(0x7f0000000000)=0x20) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f00000000c0)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000000c0)=ANY=[], 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000100)={0x0, 0x2, 0x0, 0x101}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000001c0)={0x0, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) r6 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000440)={'bridge0\x00', 0x0}) r8 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r8}) sendmsg$nl_route(r8, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r7}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r2, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x60, r4, 0x4, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg1\x00'}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x1020}, 0xc084) r9 = socket$igmp(0x2, 0x3, 0x2) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000200)=@generic={&(0x7f0000000140)='./file0\x00', 0x0, 0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_wireguard(r9, 0x541b, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r9, 0x80089419, &(0x7f0000000040)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, 0x90) r10 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r10, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) 00:26:53 executing program 3: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 643.896916][T15486] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 3: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000002d01", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) 00:26:53 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="c9e818e1ff0324798b80653b69aea9ffa6a56c1b9528d5d97d2085089f10eb5f6590df6fc7c74f3d2eef8680fc00cec9185c9965184b5647759829bb89c0e0d80ad643b19e43b0219329cd4a9e181f3424fd12bd094d94a7fea41933d28264a7a0c9be4f0d2e949800493ba587b6af6d4f7b76893cef36bca6c299"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket(0x11, 0x80000, 0x6) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r5}, 0x90) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r6, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYRESHEX=r6, @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}, 0x1, 0x0, 0x0, 0x4004801}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r10 = openat$cgroup(r7, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r10, &(0x7f00000002c0)='cpu.stat\x00', 0x0, 0x0) write$binfmt_script(r9, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r8, r7, 0x0, 0x10000a006) 00:26:53 executing program 3: socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 644.070714][T15495] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000003f01", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 00:26:53 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) socket$vsock_stream(0x28, 0x1, 0x0) mmap(&(0x7f0000634000/0x1000)=nil, 0x1000, 0x0, 0x110, r3, 0x6cd7d000) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x541b, 0x0) sendfile(r0, r5, 0x0, 0x800000000000005) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, 0x7, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3ff}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x60}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x8080}, 0x800) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) mmap(&(0x7f0000634000/0x1000)=nil, 0x1000, 0x0, 0x110, r3, 0x6cd7d000) (async) socket$igmp(0x2, 0x3, 0x2) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x541b, 0x0) (async) sendfile(r0, r5, 0x0, 0x800000000000005) (async) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, 0x7, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3ff}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x60}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x8080}, 0x800) (async) 00:26:53 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 1) 00:26:53 executing program 3: socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:26:53 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) [ 644.253514][T15505] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:53 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000002d01", 0x2e}], 0x1}, 0x0) 00:26:54 executing program 3: socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 644.392410][T15511] FAULT_INJECTION: forcing a failure. [ 644.392410][T15511] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 644.447723][T15517] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 644.481816][T15511] CPU: 1 PID: 15511 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 644.492300][T15511] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 644.502570][T15511] Call Trace: [ 644.505888][T15511] [ 644.508848][T15511] dump_stack_lvl+0x125/0x1b0 [ 644.513592][T15511] should_fail_ex+0x496/0x5b0 [ 644.518325][T15511] _copy_from_user+0x30/0xf0 [ 644.522971][T15511] copy_msghdr_from_user+0x99/0x160 [ 644.528238][T15511] ? __copy_msghdr+0x460/0x460 [ 644.533076][T15511] ? find_held_lock+0x2d/0x110 [ 644.537995][T15511] ___sys_sendmsg+0xff/0x1d0 [ 644.542738][T15511] ? do_recvmmsg+0x740/0x740 [ 644.547427][T15511] ? find_held_lock+0x2d/0x110 [ 644.552286][T15511] ? __fget_light+0xe6/0x260 [ 644.556993][T15511] __sys_sendmsg+0x117/0x1e0 [ 644.561644][T15511] ? __sys_sendmsg_sock+0x30/0x30 [ 644.566745][T15511] ? syscall_enter_from_user_mode+0x7f/0x120 [ 644.572784][T15511] do_syscall_64+0x40/0x110 [ 644.577352][T15511] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 644.583297][T15511] RIP: 0033:0x7f4d1ba7cce9 [ 644.587751][T15511] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 644.607744][T15511] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 644.616289][T15511] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 644.624298][T15511] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 644.632307][T15511] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 644.640401][T15511] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 00:26:54 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001202", 0x2e}], 0x1}, 0x0) 00:26:54 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r2, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r1, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000240)=ANY=[], 0x3af4701e) socket$vsock_stream(0x28, 0x1, 0x0) (async) mmap(&(0x7f0000634000/0x1000)=nil, 0x1000, 0x0, 0x110, r3, 0x6cd7d000) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x541b, 0x0) (async) sendfile(r0, r5, 0x0, 0x800000000000005) sendmsg$IPSET_CMD_LIST(r4, &(0x7f0000000380)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x58, 0x7, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0x9}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x3ff}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x60}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x8080}, 0x800) [ 644.648406][T15511] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 644.656437][T15511] [ 644.712633][T15526] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:54 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) 00:26:54 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x3000000}, 0x0) 00:26:54 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 2) 00:26:54 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001204", 0x2e}], 0x1}, 0x0) 00:26:54 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.sectors_recursive\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:54 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="c9e818e1ff0324798b80653b69aea9ffa6a56c1b9528d5d97d2085089f10eb5f6590df6fc7c74f3d2eef8680fc00cec9185c9965184b5647759829bb89c0e0d80ad643b19e43b0219329cd4a9e181f3424fd12bd094d94a7fea41933d28264a7a0c9be4f0d2e949800493ba587b6af6d4f7b76893cef36bca6c299"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket(0x11, 0x80000, 0x6) (async, rerun: 64) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r5}, 0x90) (async, rerun: 32) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) sendmsg$BATADV_CMD_GET_HARDIF(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r6, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYRESHEX=r6, @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}, 0x1, 0x0, 0x0, 0x4004801}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r10 = openat$cgroup(r7, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r10, &(0x7f00000002c0)='cpu.stat\x00', 0x0, 0x0) write$binfmt_script(r9, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r8, r7, 0x0, 0x10000a006) 00:26:54 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) [ 645.088733][T15537] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 645.106643][T15538] FAULT_INJECTION: forcing a failure. [ 645.106643][T15538] name failslab, interval 1, probability 0, space 0, times 0 [ 645.147865][T15538] CPU: 0 PID: 15538 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 645.158362][T15538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 645.168444][T15538] Call Trace: [ 645.171756][T15538] [ 645.174788][T15538] dump_stack_lvl+0x125/0x1b0 [ 645.179530][T15538] should_fail_ex+0x496/0x5b0 [ 645.184251][T15538] should_failslab+0x9/0x20 [ 645.188875][T15538] kmem_cache_alloc_node+0x71/0x330 [ 645.194363][T15538] ? __alloc_skb+0x287/0x330 [ 645.199011][T15538] __alloc_skb+0x287/0x330 [ 645.203490][T15538] ? __napi_build_skb+0x50/0x50 [ 645.208397][T15538] ? __netlink_dump_start+0x9c0/0x9c0 [ 645.213814][T15538] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 645.219784][T15538] netlink_alloc_large_skb+0x4d/0xf0 [ 645.225119][T15538] netlink_sendmsg+0x688/0xd70 [ 645.229928][T15538] ? netlink_unicast+0x810/0x810 [ 645.234890][T15538] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 645.240198][T15538] ? netlink_unicast+0x810/0x810 [ 645.245145][T15538] __sock_sendmsg+0xd5/0x180 [ 645.249767][T15538] ____sys_sendmsg+0x6ac/0x940 [ 645.254568][T15538] ? copy_msghdr_from_user+0x10b/0x160 [ 645.260056][T15538] ? kernel_sendmsg+0x50/0x50 [ 645.264757][T15538] ? find_held_lock+0x2d/0x110 [ 645.269551][T15538] ___sys_sendmsg+0x135/0x1d0 [ 645.274337][T15538] ? do_recvmmsg+0x740/0x740 [ 645.278948][T15538] ? find_held_lock+0x2d/0x110 [ 645.283759][T15538] ? __fget_light+0xe6/0x260 [ 645.288450][T15538] __sys_sendmsg+0x117/0x1e0 [ 645.293059][T15538] ? __sys_sendmsg_sock+0x30/0x30 [ 645.298116][T15538] ? syscall_enter_from_user_mode+0x7f/0x120 [ 645.304239][T15538] do_syscall_64+0x40/0x110 [ 645.308874][T15538] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 645.314903][T15538] RIP: 0033:0x7f4d1ba7cce9 [ 645.319338][T15538] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 645.339249][T15538] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 00:26:54 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) [ 645.347715][T15538] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 645.355698][T15538] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 645.363894][T15538] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 645.371900][T15538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 645.379994][T15538] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 645.387999][T15538] 00:26:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 3) 00:26:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 00:26:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001205", 0x2e}], 0x1}, 0x0) 00:26:55 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 00:26:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 4) 00:26:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x6000000}, 0x0) [ 645.597316][T15553] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:55 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 00:26:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001207", 0x2e}], 0x1}, 0x0) 00:26:55 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.sectors_recursive\x00', 0xb00000000065808, 0x0) (async, rerun: 64) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:55 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 32) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="c9e818e1ff0324798b80653b69aea9ffa6a56c1b9528d5d97d2085089f10eb5f6590df6fc7c74f3d2eef8680fc00cec9185c9965184b5647759829bb89c0e0d80ad643b19e43b0219329cd4a9e181f3424fd12bd094d94a7fea41933d28264a7a0c9be4f0d2e949800493ba587b6af6d4f7b76893cef36bca6c299"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) socket(0x11, 0x80000, 0x6) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r5}, 0x90) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r5, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r6, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async, rerun: 32) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYRESHEX=r6, @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}, 0x1, 0x0, 0x0, 0x4004801}, 0x0) (rerun: 32) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r10 = openat$cgroup(r7, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r10, &(0x7f00000002c0)='cpu.stat\x00', 0x0, 0x0) (async) write$binfmt_script(r9, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r8, r7, 0x0, 0x10000a006) [ 645.639397][T15559] FAULT_INJECTION: forcing a failure. [ 645.639397][T15559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 645.718484][T15559] CPU: 0 PID: 15559 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 645.729062][T15559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 645.739151][T15559] Call Trace: [ 645.742456][T15559] [ 645.745412][T15559] dump_stack_lvl+0x125/0x1b0 [ 645.750145][T15559] should_fail_ex+0x496/0x5b0 [ 645.754888][T15559] _copy_from_iter+0x246/0x10f0 [ 645.759809][T15559] ? __alloc_skb+0x1c5/0x330 [ 645.764455][T15559] ? page_copy_sane+0x2c0/0x2c0 [ 645.769374][T15559] ? __napi_build_skb+0x50/0x50 [ 645.774283][T15559] ? __netlink_dump_start+0x9c0/0x9c0 [ 645.779700][T15559] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 645.785660][T15559] ? __virt_addr_valid+0x5e/0x2d0 [ 645.790731][T15559] ? __phys_addr_symbol+0x30/0x70 [ 645.795812][T15559] ? __check_object_size+0x323/0x730 [ 645.801250][T15559] netlink_sendmsg+0x812/0xd70 [ 645.806161][T15559] ? netlink_unicast+0x810/0x810 [ 645.811151][T15559] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 645.816487][T15559] ? netlink_unicast+0x810/0x810 [ 645.821478][T15559] __sock_sendmsg+0xd5/0x180 [ 645.826118][T15559] ____sys_sendmsg+0x6ac/0x940 [ 645.830933][T15559] ? copy_msghdr_from_user+0x10b/0x160 [ 645.836447][T15559] ? kernel_sendmsg+0x50/0x50 [ 645.841183][T15559] ? find_held_lock+0x2d/0x110 [ 645.846006][T15559] ___sys_sendmsg+0x135/0x1d0 [ 645.850738][T15559] ? do_recvmmsg+0x740/0x740 [ 645.855382][T15559] ? find_held_lock+0x2d/0x110 [ 645.860226][T15559] ? __fget_light+0xe6/0x260 [ 645.864867][T15559] __sys_sendmsg+0x117/0x1e0 [ 645.869597][T15559] ? __sys_sendmsg_sock+0x30/0x30 [ 645.874772][T15559] ? syscall_enter_from_user_mode+0x7f/0x120 [ 645.880803][T15559] do_syscall_64+0x40/0x110 [ 645.885450][T15559] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 645.891391][T15559] RIP: 0033:0x7f4d1ba7cce9 [ 645.895839][T15559] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 00:26:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x7000000}, 0x0) 00:26:55 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x8000000}, 0x0) [ 645.915556][T15559] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 645.924010][T15559] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 645.932104][T15559] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 645.940110][T15559] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 645.948118][T15559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 645.956209][T15559] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 645.964238][T15559] 00:26:55 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="c9e8da147418e1ffee00e0725b8b4b03"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:55 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) 00:26:55 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800000120a", 0x2e}], 0x1}, 0x0) 00:26:55 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 5) [ 646.109104][T15581] FAULT_INJECTION: forcing a failure. [ 646.109104][T15581] name failslab, interval 1, probability 0, space 0, times 0 [ 646.124570][T15581] CPU: 1 PID: 15581 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 646.135043][T15581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 646.145132][T15581] Call Trace: [ 646.148434][T15581] [ 646.151381][T15581] dump_stack_lvl+0x125/0x1b0 [ 646.156088][T15581] should_fail_ex+0x496/0x5b0 [ 646.160813][T15581] should_failslab+0x9/0x20 [ 646.165335][T15581] kmem_cache_alloc+0x69/0x2f0 [ 646.170123][T15581] skb_clone+0x171/0x3c0 [ 646.174388][T15581] netlink_deliver_tap+0xb35/0xd00 [ 646.179625][T15581] netlink_unicast+0x5fa/0x810 [ 646.184417][T15581] ? netlink_attachskb+0x880/0x880 [ 646.189535][T15581] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 646.195445][T15581] ? __phys_addr_symbol+0x30/0x70 [ 646.200482][T15581] ? __check_object_size+0x323/0x730 [ 646.205789][T15581] netlink_sendmsg+0x8b7/0xd70 [ 646.210567][T15581] ? netlink_unicast+0x810/0x810 [ 646.215516][T15581] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 646.220819][T15581] ? netlink_unicast+0x810/0x810 [ 646.225771][T15581] __sock_sendmsg+0xd5/0x180 [ 646.230383][T15581] ____sys_sendmsg+0x6ac/0x940 [ 646.235176][T15581] ? copy_msghdr_from_user+0x10b/0x160 [ 646.240654][T15581] ? kernel_sendmsg+0x50/0x50 [ 646.245359][T15581] ? find_held_lock+0x2d/0x110 [ 646.250159][T15581] ___sys_sendmsg+0x135/0x1d0 [ 646.254857][T15581] ? do_recvmmsg+0x740/0x740 [ 646.259463][T15581] ? find_held_lock+0x2d/0x110 [ 646.264271][T15581] ? __fget_light+0xe6/0x260 [ 646.268877][T15581] __sys_sendmsg+0x117/0x1e0 [ 646.273485][T15581] ? __sys_sendmsg_sock+0x30/0x30 [ 646.278545][T15581] ? syscall_enter_from_user_mode+0x7f/0x120 [ 646.284546][T15581] do_syscall_64+0x40/0x110 [ 646.289071][T15581] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 646.294979][T15581] RIP: 0033:0x7f4d1ba7cce9 [ 646.299401][T15581] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 646.319021][T15581] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 646.327451][T15581] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 646.335432][T15581] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 646.343409][T15581] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 646.351383][T15581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 646.359357][T15581] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 646.367381][T15581] 00:26:56 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 32) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (rerun: 32) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (rerun: 32) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.sectors_recursive\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001210", 0x2e}], 0x1}, 0x0) 00:26:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 6) 00:26:56 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)}, 0x0) 00:26:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001225", 0x2e}], 0x1}, 0x0) 00:26:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) 00:26:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001218", 0x2e}], 0x1}, 0x0) [ 646.638267][T15597] FAULT_INJECTION: forcing a failure. [ 646.638267][T15597] name failslab, interval 1, probability 0, space 0, times 0 [ 646.676448][T15597] CPU: 0 PID: 15597 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 646.686941][T15597] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 646.697036][T15597] Call Trace: [ 646.700355][T15597] [ 646.703309][T15597] dump_stack_lvl+0x125/0x1b0 [ 646.708042][T15597] should_fail_ex+0x496/0x5b0 [ 646.712770][T15597] should_failslab+0x9/0x20 [ 646.717331][T15597] kmem_cache_alloc_node+0x71/0x330 [ 646.722581][T15597] ? __alloc_skb+0x287/0x330 [ 646.727232][T15597] __alloc_skb+0x287/0x330 [ 646.731700][T15597] ? __napi_build_skb+0x50/0x50 [ 646.736599][T15597] ? __nla_parse+0x40/0x50 [ 646.741069][T15597] rtm_get_nexthop+0x1a8/0x4d0 [ 646.746365][T15597] ? nh_fill_node+0x1440/0x1440 [ 646.751267][T15597] ? nh_fill_node+0x1440/0x1440 [ 646.756155][T15597] rtnetlink_rcv_msg+0x3c7/0xe00 [ 646.761150][T15597] ? rtnl_fill_vf+0x490/0x490 [ 646.765898][T15597] netlink_rcv_skb+0x16b/0x440 [ 646.770724][T15597] ? rtnl_fill_vf+0x490/0x490 [ 646.775445][T15597] ? netlink_ack+0x1380/0x1380 [ 646.780266][T15597] ? netlink_deliver_tap+0x1a0/0xd00 [ 646.785594][T15597] netlink_unicast+0x53b/0x810 [ 646.790380][T15597] ? netlink_attachskb+0x880/0x880 [ 646.795522][T15597] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 646.802336][T15597] ? __phys_addr_symbol+0x30/0x70 [ 646.807418][T15597] ? __check_object_size+0x323/0x730 [ 646.812802][T15597] netlink_sendmsg+0x8b7/0xd70 [ 646.817585][T15597] ? netlink_unicast+0x810/0x810 [ 646.822743][T15597] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 646.828078][T15597] ? netlink_unicast+0x810/0x810 [ 646.833057][T15597] __sock_sendmsg+0xd5/0x180 [ 646.837696][T15597] ____sys_sendmsg+0x6ac/0x940 [ 646.842504][T15597] ? copy_msghdr_from_user+0x10b/0x160 [ 646.848087][T15597] ? kernel_sendmsg+0x50/0x50 [ 646.852794][T15597] ? find_held_lock+0x2d/0x110 [ 646.857596][T15597] ___sys_sendmsg+0x135/0x1d0 [ 646.862314][T15597] ? do_recvmmsg+0x740/0x740 [ 646.867038][T15597] ? find_held_lock+0x2d/0x110 [ 646.871885][T15597] ? __fget_light+0xe6/0x260 [ 646.876535][T15597] __sys_sendmsg+0x117/0x1e0 [ 646.881188][T15597] ? __sys_sendmsg_sock+0x30/0x30 [ 646.886286][T15597] ? syscall_enter_from_user_mode+0x7f/0x120 [ 646.892311][T15597] do_syscall_64+0x40/0x110 [ 646.896856][T15597] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 646.902789][T15597] RIP: 0033:0x7f4d1ba7cce9 [ 646.907226][T15597] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 646.927024][T15597] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 00:26:56 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9e81800000002a281699671d9294cb3eec5bad960e429ea6467803b856cc4ae003dbfec600879626f406e333ad20e7f6e2ac4b5fb04147ef169"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000000)) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) [ 646.935477][T15597] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 646.943480][T15597] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 646.951486][T15597] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 646.959509][T15597] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 646.967533][T15597] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 646.975739][T15597] [ 647.186375][ T28] kauditd_printk_skb: 22 callbacks suppressed [ 647.186391][ T28] audit: type=1804 audit(1704328016.833:2166): pid=15608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/259/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:26:56 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="c9e8da147418e1ffee00e0725b8b4b03"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:56 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)}, 0x0) 00:26:56 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001200", 0x2e}], 0x1}, 0x0) 00:26:56 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xc000000}, 0x0) 00:26:56 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 7) [ 647.235742][ T28] audit: type=1804 audit(1704328016.833:2167): pid=15608 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/259/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:26:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001224", 0x2e}], 0x1}, 0x0) 00:26:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 8) 00:26:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xe000000}, 0x0) [ 647.343642][ T28] audit: type=1804 audit(1704328016.983:2168): pid=15616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/889/cgroup.controllers" dev="sda1" ino=1968 res=1 errno=0 00:26:57 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)}, 0x0) 00:26:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001236", 0x2e}], 0x1}, 0x0) [ 647.488755][T15622] FAULT_INJECTION: forcing a failure. [ 647.488755][T15622] name failslab, interval 1, probability 0, space 0, times 0 [ 647.514799][ T28] audit: type=1804 audit(1704328017.163:2169): pid=15623 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/890/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 [ 647.549701][T15622] CPU: 1 PID: 15622 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 647.560186][T15622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 647.570271][T15622] Call Trace: [ 647.573590][T15622] [ 647.576546][T15622] dump_stack_lvl+0x125/0x1b0 [ 647.581282][T15622] should_fail_ex+0x496/0x5b0 [ 647.586028][T15622] should_failslab+0x9/0x20 [ 647.590595][T15622] kmem_cache_alloc_node+0x71/0x330 [ 647.595846][T15622] ? __alloc_skb+0x287/0x330 [ 647.600497][T15622] __alloc_skb+0x287/0x330 [ 647.604968][T15622] ? __napi_build_skb+0x50/0x50 [ 647.609879][T15622] netlink_ack+0x3bb/0x1380 [ 647.614425][T15622] ? rtnl_fill_vf+0x490/0x490 [ 647.618985][ T28] audit: type=1804 audit(1704328017.203:2170): pid=15626 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/438/cgroup.controllers" dev="sda1" ino=1977 res=1 errno=0 [ 647.619129][T15622] ? netlink_sendmsg+0xd70/0xd70 [ 647.650659][T15622] netlink_rcv_skb+0x345/0x440 [ 647.655463][T15622] ? rtnl_fill_vf+0x490/0x490 [ 647.660182][T15622] ? netlink_ack+0x1380/0x1380 [ 647.665009][T15622] ? netlink_deliver_tap+0x1a0/0xd00 [ 647.670359][T15622] netlink_unicast+0x53b/0x810 [ 647.675169][T15622] ? netlink_attachskb+0x880/0x880 [ 647.680309][T15622] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 647.686251][T15622] ? __phys_addr_symbol+0x30/0x70 [ 647.689074][ T28] audit: type=1804 audit(1704328017.203:2171): pid=15629 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/438/cgroup.controllers" dev="sda1" ino=1977 res=1 errno=0 [ 647.691299][T15622] ? __check_object_size+0x323/0x730 [ 647.691345][T15622] netlink_sendmsg+0x8b7/0xd70 [ 647.727396][T15622] ? netlink_unicast+0x810/0x810 [ 647.732390][T15622] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 647.737722][T15622] ? netlink_unicast+0x810/0x810 [ 647.741829][ T28] audit: type=1804 audit(1704328017.323:2172): pid=15632 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/891/cgroup.controllers" dev="sda1" ino=1966 res=1 errno=0 [ 647.742678][T15622] __sock_sendmsg+0xd5/0x180 [ 647.742723][T15622] ____sys_sendmsg+0x6ac/0x940 [ 647.778588][T15622] ? copy_msghdr_from_user+0x10b/0x160 [ 647.784136][T15622] ? kernel_sendmsg+0x50/0x50 00:26:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf000000}, 0x0) [ 647.788870][T15622] ? find_held_lock+0x2d/0x110 [ 647.793688][T15622] ___sys_sendmsg+0x135/0x1d0 [ 647.798416][T15622] ? do_recvmmsg+0x740/0x740 [ 647.803062][T15622] ? find_held_lock+0x2d/0x110 [ 647.807907][T15622] ? __fget_light+0xe6/0x260 [ 647.812540][T15622] __sys_sendmsg+0x117/0x1e0 [ 647.817182][T15622] ? __sys_sendmsg_sock+0x30/0x30 [ 647.822277][T15622] ? syscall_enter_from_user_mode+0x7f/0x120 [ 647.828292][T15622] do_syscall_64+0x40/0x110 [ 647.832807][T15622] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 647.838702][T15622] RIP: 0033:0x7f4d1ba7cce9 [ 647.843110][T15622] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 647.862824][T15622] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 647.871274][T15622] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 647.879305][T15622] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 647.887273][T15622] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 647.895241][T15622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 647.903225][T15622] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 647.911519][T15622] 00:26:57 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9e81800000002a281699671d9294cb3eec5bad960e429ea6467803b856cc4ae003dbfec600879626f406e333ad20e7f6e2ac4b5fb04147ef169"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async, rerun: 32) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (rerun: 32) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000000)) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x10000000}, 0x0) 00:26:57 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}, 0x0) 00:26:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001239", 0x2e}], 0x1}, 0x0) 00:26:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 9) 00:26:57 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="c9e8da147418e1ffee00e0725b8b4b03"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800000122d", 0x2e}], 0x1}, 0x0) 00:26:57 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}, 0x0) 00:26:57 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x26030000}, 0x0) [ 648.129286][ T28] audit: type=1804 audit(1704328017.773:2173): pid=15635 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/892/cgroup.controllers" dev="sda1" ino=1968 res=1 errno=0 00:26:57 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000012f2", 0x2e}], 0x1}, 0x0) 00:26:57 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 10) [ 648.214644][ T28] audit: type=1804 audit(1704328017.843:2174): pid=15650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/439/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 00:26:57 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{0x0}], 0x1}, 0x0) [ 648.316629][ T28] audit: type=1804 audit(1704328017.843:2175): pid=15648 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/439/cgroup.controllers" dev="sda1" ino=1975 res=1 errno=0 [ 648.346828][T15657] FAULT_INJECTION: forcing a failure. [ 648.346828][T15657] name failslab, interval 1, probability 0, space 0, times 0 [ 648.362270][T15657] CPU: 0 PID: 15657 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 648.372740][T15657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 648.382830][T15657] Call Trace: [ 648.386139][T15657] [ 648.389101][T15657] dump_stack_lvl+0x125/0x1b0 [ 648.389298][T15659] validate_nla: 10 callbacks suppressed [ 648.389313][T15659] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 648.393903][T15657] should_fail_ex+0x496/0x5b0 [ 648.393943][T15657] should_failslab+0x9/0x20 [ 648.416899][T15657] kmem_cache_alloc+0x69/0x2f0 [ 648.421706][T15657] skb_clone+0x171/0x3c0 [ 648.425974][T15657] netlink_deliver_tap+0xb35/0xd00 [ 648.431116][T15657] netlink_unicast+0x6b4/0x810 [ 648.435900][T15657] ? netlink_attachskb+0x880/0x880 [ 648.441034][T15657] netlink_ack+0x870/0x1380 [ 648.445557][T15657] ? netlink_sendmsg+0xd70/0xd70 [ 648.450514][T15657] netlink_rcv_skb+0x345/0x440 [ 648.455288][T15657] ? rtnl_fill_vf+0x490/0x490 [ 648.459990][T15657] ? netlink_ack+0x1380/0x1380 [ 648.464804][T15657] ? netlink_deliver_tap+0x1a0/0xd00 [ 648.470125][T15657] netlink_unicast+0x53b/0x810 [ 648.474911][T15657] ? netlink_attachskb+0x880/0x880 [ 648.480056][T15657] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 648.485992][T15657] ? __phys_addr_symbol+0x30/0x70 [ 648.491044][T15657] ? __check_object_size+0x323/0x730 [ 648.496372][T15657] netlink_sendmsg+0x8b7/0xd70 [ 648.501176][T15657] ? netlink_unicast+0x810/0x810 [ 648.506158][T15657] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 648.511495][T15657] ? netlink_unicast+0x810/0x810 [ 648.516465][T15657] __sock_sendmsg+0xd5/0x180 [ 648.521445][T15657] ____sys_sendmsg+0x6ac/0x940 [ 648.526233][T15657] ? copy_msghdr_from_user+0x10b/0x160 [ 648.531742][T15657] ? kernel_sendmsg+0x50/0x50 [ 648.536443][T15657] ? find_held_lock+0x2d/0x110 [ 648.541321][T15657] ___sys_sendmsg+0x135/0x1d0 [ 648.546052][T15657] ? do_recvmmsg+0x740/0x740 [ 648.550673][T15657] ? find_held_lock+0x2d/0x110 [ 648.555497][T15657] ? __fget_light+0xe6/0x260 [ 648.560114][T15657] __sys_sendmsg+0x117/0x1e0 [ 648.564737][T15657] ? __sys_sendmsg_sock+0x30/0x30 [ 648.569809][T15657] ? syscall_enter_from_user_mode+0x7f/0x120 [ 648.575810][T15657] do_syscall_64+0x40/0x110 [ 648.580336][T15657] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 648.586242][T15657] RIP: 0033:0x7f4d1ba7cce9 [ 648.590660][T15657] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 648.610275][T15657] RSP: 002b:00007f4d1c78e0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 648.618718][T15657] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7cce9 [ 648.626692][T15657] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 648.634670][T15657] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 648.642643][T15657] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 648.650616][T15657] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 648.658619][T15657] 00:26:58 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9e81800000002a281699671d9294cb3eec5bad960e429ea6467803b856cc4ae003dbfec600879626f406e333ad20e7f6e2ac4b5fb04147ef169"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000000)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) (fail_nth: 11) 00:26:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x60000000}, 0x0) 00:26:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000012f8", 0x2e}], 0x1}, 0x0) 00:26:58 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)}], 0x1}, 0x0) [ 648.826854][T15666] FAULT_INJECTION: forcing a failure. [ 648.826854][T15666] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 648.860562][T15666] CPU: 1 PID: 15666 Comm: syz-executor.2 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 648.871212][T15666] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 648.881384][T15666] Call Trace: [ 648.884696][T15666] [ 648.887658][T15666] dump_stack_lvl+0x125/0x1b0 [ 648.892391][T15666] should_fail_ex+0x496/0x5b0 [ 648.897120][T15666] _copy_to_user+0x30/0xb0 [ 648.901676][T15666] simple_read_from_buffer+0xd0/0x160 [ 648.907101][T15666] proc_fail_nth_read+0x1b0/0x280 [ 648.912184][T15666] ? proc_fault_inject_read+0x280/0x280 [ 648.917761][T15666] ? security_file_permission+0xdc/0x100 [ 648.923415][T15666] ? proc_fault_inject_read+0x280/0x280 [ 648.928980][T15666] vfs_read+0x1ce/0x8f0 [ 648.933148][T15666] ? __fdget_pos+0xe7/0x170 [ 648.937659][T15666] ? kernel_read+0x1b0/0x1b0 [ 648.942365][T15666] ? mutex_trylock+0x130/0x130 [ 648.947236][T15666] ? __fget_files+0x1c6/0x340 [ 648.951931][T15666] ksys_read+0x12f/0x250 [ 648.956184][T15666] ? vfs_write+0xdf0/0xdf0 [ 648.960616][T15666] ? syscall_enter_from_user_mode+0x7f/0x120 [ 648.966619][T15666] do_syscall_64+0x40/0x110 [ 648.971141][T15666] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 648.977047][T15666] RIP: 0033:0x7f4d1ba7b98c [ 648.981480][T15666] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 af 81 02 00 48 [ 649.001104][T15666] RSP: 002b:00007f4d1c78e0c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 649.009616][T15666] RAX: ffffffffffffffda RBX: 00007f4d1bb9bf80 RCX: 00007f4d1ba7b98c [ 649.017678][T15666] RDX: 000000000000000f RSI: 00007f4d1c78e130 RDI: 0000000000000004 [ 649.026260][T15666] RBP: 00007f4d1c78e120 R08: 0000000000000000 R09: 0000000000000000 [ 649.034582][T15666] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 649.042556][T15666] R13: 000000000000000b R14: 00007f4d1bb9bf80 R15: 00007ffc55043188 [ 649.050635][T15666] [ 649.055862][T15671] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x65580000}, 0x0) 00:26:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:26:58 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="08849eef", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:26:58 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000012f9", 0x2e}], 0x1}, 0x0) 00:26:58 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 00:26:58 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:26:58 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x81000000}, 0x0) [ 649.267005][T15679] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:59 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000181100003723b7f0ad1bc23541519f25f58de187ad46ae4bcccd2da594517814b9dbc96d466514cf3e268afc84b2d09392", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r2 = openat$cgroup_ro(r0, &(0x7f0000000180)='io.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) 00:26:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba80000012fe", 0x2e}], 0x1}, 0x0) 00:26:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:26:59 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 00:26:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x88a8ffff}, 0x0) 00:26:59 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d0000", 0x17}], 0x1}, 0x0) [ 649.733029][T15696] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:59 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x3, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:26:59 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) 00:26:59 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba800000121f", 0x2e}], 0x1}, 0x0) 00:26:59 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d0000", 0x17}], 0x1}, 0x0) 00:26:59 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="08849eef", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="08849eef", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) (async) [ 650.106398][T15706] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:26:59 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d0000", 0x17}], 0x1}, 0x0) 00:27:00 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000181100003723b7f0ad1bc23541519f25f58de187ad46ae4bcccd2da594517814b9dbc96d466514cf3e268afc84b2d09392", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) r2 = openat$cgroup_ro(r0, &(0x7f0000000180)='io.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:00 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="08849eef", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:00 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 00:27:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x4, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0xa}], 0x1}, 0x0) 00:27:00 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a", 0x23}], 0x1}, 0x0) 00:27:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0xf}], 0x1}, 0x0) 00:27:00 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x5, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:00 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a", 0x23}], 0x1}, 0x0) 00:27:00 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xffffa888}, 0x0) 00:27:00 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r7 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) sendmsg$NL80211_CMD_LEAVE_MESH(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x40, 0x6b}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x24044880) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:00 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a", 0x23}], 0x1}, 0x0) 00:27:01 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000181100003723b7f0ad1bc23541519f25f58de187ad46ae4bcccd2da594517814b9dbc96d466514cf3e268afc84b2d09392", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r0) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) r2 = openat$cgroup_ro(r0, &(0x7f0000000180)='io.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:01 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x10}], 0x1}, 0x0) 00:27:01 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x6, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:01 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) 00:27:01 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba", 0x29}], 0x1}, 0x0) 00:27:01 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r7 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) sendmsg$NL80211_CMD_LEAVE_MESH(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x40, 0x6b}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x24044880) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:02 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba", 0x29}], 0x1}, 0x0) 00:27:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x25}], 0x1}, 0x0) 00:27:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x7, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 652.410035][ T28] kauditd_printk_skb: 27 callbacks suppressed [ 652.410051][ T28] audit: type=1804 audit(1704328022.063:2203): pid=15755 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/901/cgroup.controllers" dev="sda1" ino=1950 res=1 errno=0 00:27:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) 00:27:02 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) r7 = accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) sendmsg$NL80211_CMD_LEAVE_MESH(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x40, 0x6b}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x24044880) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x80000) (async) sendmsg$NL80211_CMD_LEAVE_MESH(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x200, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x40, 0x6b}}}}, [""]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x24044880) (async) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) (async) 00:27:02 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba", 0x29}], 0x1}, 0x0) [ 652.590544][ T28] audit: type=1804 audit(1704328022.233:2204): pid=15764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/902/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 [ 652.749027][ T28] audit: type=1804 audit(1704328022.403:2205): pid=15770 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/445/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 652.814956][ T28] audit: type=1804 audit(1704328022.403:2206): pid=15770 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/445/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 652.858191][ T28] audit: type=1804 audit(1704328022.503:2207): pid=15772 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/445/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 653.009440][ T28] audit: type=1804 audit(1704328022.663:2208): pid=15782 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/264/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:02 executing program 0: pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xae5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:02 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055150100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r4}, 0x90) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c00e2ffea0e201085e2a5b5a61309a4067c3077c0ee77d9640a69928d962f74864c27f339aee1902f280c11dcf864a0427405902f56faef63d362700a880b6f35ce01ebdc549b38c752395c2e33427e1ea82b6ebdafd087bd1c79c0d4ae94e510a4b33d16d4e2115998197d8bd430eeb59b1467cc1f0f133d7120a14fcb843bcf469dc0af652cbe48eb6ddf926807a006cf8d10d5d14365bfbf900146fbf58c02cbcb4a2c", @ANYRES16=r5, @ANYBLOB="00022cbd7000fddbdf25050000000500380000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000005c0)={0x0, 0xdb}, 0xc) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0xfffffff9, 0x0, 0xffffffffffffffff, 0x3f, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x5}, 0x48) r8 = bpf$ITER_CREATE(0x21, &(0x7f00000008c0)={r1}, 0x8) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r10}, 0x90) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r10, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r11, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x5, 0x20, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xde, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x2}, @generic={0x40, 0x5, 0x6, 0x8}, @exit, @generic={0x3, 0x8, 0xb, 0x401, 0x9}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x80000001}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000700)='GPL\x00', 0x3, 0x57, &(0x7f0000000740)=""/87, 0x40f00, 0x50, '\x00', 0x0, 0x2, r3, 0x8, &(0x7f00000007c0)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000800)={0x5, 0x1, 0x4b1bfa13, 0x7f}, 0x10, 0xffffffffffffffff, r0, 0x6, &(0x7f0000000980)=[r7, r0, r0, r8, r9, r3, r4, 0xffffffffffffffff, r10], &(0x7f00000009c0)=[{0x4, 0x3, 0x6, 0x6}, {0x1, 0x4, 0xc, 0x8}, {0x1, 0x4, 0x3, 0x6}, {0x0, 0x1, 0x8, 0x8}, {0x5, 0x1, 0xe, 0x4}, {0x3, 0x3, 0xe, 0x5}], 0x10, 0x8}, 0x90) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40a0140}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x38, 0x140e, 0x25a2b43099805813, 0x70bd28, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0xc804}, 0x1) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="00080000898a18ecf8b1104e9a922b5ec4bc083373eadebba4ac4268353e550ea43b99f54e34612eba860e301dc1761eda3447d45355c62354ce7a131de22901c0401322968ecad523c732f0a7ca9efae2c60d07f48038247745302ceb891cad52c81356c3351bc33d348d2e7a9edcb3f6e7bcd2f1abaa23b84295cc29c4f81fa05ed8ffc97358c2ff487354fa80364806e858395c322d9b43de9ffb2ca4c38de40c2b495d37bf8a40f3108638ef0c57e1425b5879a7508d67f1e51fb826ea85181cd23407000000981b036bd3115dd8a31fe75bb40c8ada7b014852bdce2065aecea4792c42c41dabf9e9591b1161a307e18d9d50a07c926e", @ANYRESDEC=r0, @ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3aff7f0000080211000001975050505050"], 0x448}}, 0x4000081) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r13, r12, 0x0, 0x10000a006) 00:27:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x140}], 0x1}, 0x0) 00:27:02 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba800000", 0x2c}], 0x1}, 0x0) 00:27:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) [ 653.057102][ T28] audit: type=1804 audit(1704328022.663:2209): pid=15780 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/264/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 653.118538][ T28] audit: type=1804 audit(1704328022.663:2210): pid=15780 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/264/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:02 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x9, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:02 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba800000", 0x2c}], 0x1}, 0x0) [ 653.171200][T15791] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:02 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) 00:27:02 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0xec0}], 0x1}, 0x0) [ 653.216187][ T28] audit: type=1804 audit(1704328022.663:2211): pid=15780 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/264/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 [ 653.315197][ T28] audit: type=1804 audit(1704328022.663:2212): pid=15780 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/264/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:03 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba800000", 0x2c}], 0x1}, 0x0) [ 653.368702][T15802] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xffffffff}, 0x0) 00:27:03 executing program 0: pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xae5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async, rerun: 64) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) (rerun: 64) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async, rerun: 32) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async, rerun: 32) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async, rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:03 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x33fe0}], 0x1}, 0x0) 00:27:03 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba80000012", 0x2d}], 0x1}, 0x0) 00:27:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xa, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x2) 00:27:03 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055150100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r4}, 0x90) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c00e2ffea0e201085e2a5b5a61309a4067c3077c0ee77d9640a69928d962f74864c27f339aee1902f280c11dcf864a0427405902f56faef63d362700a880b6f35ce01ebdc549b38c752395c2e33427e1ea82b6ebdafd087bd1c79c0d4ae94e510a4b33d16d4e2115998197d8bd430eeb59b1467cc1f0f133d7120a14fcb843bcf469dc0af652cbe48eb6ddf926807a006cf8d10d5d14365bfbf900146fbf58c02cbcb4a2c", @ANYRES16=r5, @ANYBLOB="00022cbd7000fddbdf25050000000500380000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000005c0)={0x0, 0xdb}, 0xc) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0xfffffff9, 0x0, 0xffffffffffffffff, 0x3f, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x5}, 0x48) r8 = bpf$ITER_CREATE(0x21, &(0x7f00000008c0)={r1}, 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) (async) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r10}, 0x90) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r10, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r11, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) sendmsg$BATADV_CMD_GET_HARDIF(r10, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r11, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x5, 0x20, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xde, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x2}, @generic={0x40, 0x5, 0x6, 0x8}, @exit, @generic={0x3, 0x8, 0xb, 0x401, 0x9}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x80000001}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000700)='GPL\x00', 0x3, 0x57, &(0x7f0000000740)=""/87, 0x40f00, 0x50, '\x00', 0x0, 0x2, r3, 0x8, &(0x7f00000007c0)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000800)={0x5, 0x1, 0x4b1bfa13, 0x7f}, 0x10, 0xffffffffffffffff, r0, 0x6, &(0x7f0000000980)=[r7, r0, r0, r8, r9, r3, r4, 0xffffffffffffffff, r10], &(0x7f00000009c0)=[{0x4, 0x3, 0x6, 0x6}, {0x1, 0x4, 0xc, 0x8}, {0x1, 0x4, 0x3, 0x6}, {0x0, 0x1, 0x8, 0x8}, {0x5, 0x1, 0xe, 0x4}, {0x3, 0x3, 0xe, 0x5}], 0x10, 0x8}, 0x90) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40a0140}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x38, 0x140e, 0x25a2b43099805813, 0x70bd28, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0xc804}, 0x1) (async) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40a0140}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x38, 0x140e, 0x25a2b43099805813, 0x70bd28, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0xc804}, 0x1) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="00080000898a18ecf8b1104e9a922b5ec4bc083373eadebba4ac4268353e550ea43b99f54e34612eba860e301dc1761eda3447d45355c62354ce7a131de22901c0401322968ecad523c732f0a7ca9efae2c60d07f48038247745302ceb891cad52c81356c3351bc33d348d2e7a9edcb3f6e7bcd2f1abaa23b84295cc29c4f81fa05ed8ffc97358c2ff487354fa80364806e858395c322d9b43de9ffb2ca4c38de40c2b495d37bf8a40f3108638ef0c57e1425b5879a7508d67f1e51fb826ea85181cd23407000000981b036bd3115dd8a31fe75bb40c8ada7b014852bdce2065aecea4792c42c41dabf9e9591b1161a307e18d9d50a07c926e", @ANYRESDEC=r0, @ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3aff7f0000080211000001975050505050"], 0x448}}, 0x4000081) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r13, r12, 0x0, 0x10000a006) (async) sendfile(r13, r12, 0x0, 0x10000a006) 00:27:03 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xc, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:03 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x3) 00:27:03 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba80000012", 0x2d}], 0x1}, 0x0) [ 654.252959][T15817] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0xfffffdef}], 0x1}, 0x0) 00:27:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xe, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:04 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba80000012", 0x2d}], 0x1}, 0x0) 00:27:04 executing program 0: pipe(&(0x7f0000002000)) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, 0x0, 0x100, 0x70bd28, 0x25dfdbfe, {}, [@BATADV_ATTR_ORIG_INTERVAL={0x8, 0x39, 0xae5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000004) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r5, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x4) 00:27:04 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async, rerun: 64) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055150100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r4}, 0x90) (async, rerun: 32) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 32) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="1c00e2ffea0e201085e2a5b5a61309a4067c3077c0ee77d9640a69928d962f74864c27f339aee1902f280c11dcf864a0427405902f56faef63d362700a880b6f35ce01ebdc549b38c752395c2e33427e1ea82b6ebdafd087bd1c79c0d4ae94e510a4b33d16d4e2115998197d8bd430eeb59b1467cc1f0f133d7120a14fcb843bcf469dc0af652cbe48eb6ddf926807a006cf8d10d5d14365bfbf900146fbf58c02cbcb4a2c", @ANYRES16=r5, @ANYBLOB="00022cbd7000fddbdf25050000000500380000000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async, rerun: 64) r6 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000005c0)={0x0, 0xdb}, 0xc) (rerun: 64) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0xfffffff9, 0x0, 0xffffffffffffffff, 0x3f, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x5}, 0x48) (async) r8 = bpf$ITER_CREATE(0x21, &(0x7f00000008c0)={r1}, 0x8) (async, rerun: 32) r9 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000900)={0x2, 0x4, 0x8, 0x1, 0x80, r3, 0x10001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x1, 0x3}, 0x48) (rerun: 32) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r10}, 0x90) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r10, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r11, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x5, 0x20, &(0x7f0000000600)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xde, 0x0, 0x0, 0x0, 0x20}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x2}, @generic={0x40, 0x5, 0x6, 0x8}, @exit, @generic={0x3, 0x8, 0xb, 0x401, 0x9}, @exit, @initr0={0x18, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x80000001}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r6}}, @btf_id={0x18, 0x3, 0x3, 0x0, 0x1}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000700)='GPL\x00', 0x3, 0x57, &(0x7f0000000740)=""/87, 0x40f00, 0x50, '\x00', 0x0, 0x2, r3, 0x8, &(0x7f00000007c0)={0xa, 0x3}, 0x8, 0x10, &(0x7f0000000800)={0x5, 0x1, 0x4b1bfa13, 0x7f}, 0x10, 0xffffffffffffffff, r0, 0x6, &(0x7f0000000980)=[r7, r0, r0, r8, r9, r3, r4, 0xffffffffffffffff, r10], &(0x7f00000009c0)=[{0x4, 0x3, 0x6, 0x6}, {0x1, 0x4, 0xc, 0x8}, {0x1, 0x4, 0x3, 0x6}, {0x0, 0x1, 0x8, 0x8}, {0x5, 0x1, 0xe, 0x4}, {0x3, 0x3, 0xe, 0x5}], 0x10, 0x8}, 0x90) (async) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r3, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40a0140}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x38, 0x140e, 0x25a2b43099805813, 0x70bd28, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_RES_PDN={0x8, 0x3c, 0x1}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_RES_PDN={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x38}, 0x1, 0x0, 0x0, 0xc804}, 0x1) (async, rerun: 32) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="00080000898a18ecf8b1104e9a922b5ec4bc083373eadebba4ac4268353e550ea43b99f54e34612eba860e301dc1761eda3447d45355c62354ce7a131de22901c0401322968ecad523c732f0a7ca9efae2c60d07f48038247745302ceb891cad52c81356c3351bc33d348d2e7a9edcb3f6e7bcd2f1abaa23b84295cc29c4f81fa05ed8ffc97358c2ff487354fa80364806e858395c322d9b43de9ffb2ca4c38de40c2b495d37bf8a40f3108638ef0c57e1425b5879a7508d67f1e51fb826ea85181cd23407000000981b036bd3115dd8a31fe75bb40c8ada7b014852bdce2065aecea4792c42c41dabf9e9591b1161a307e18d9d50a07c926e", @ANYRESDEC=r0, @ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="2c0433005000de295b3aff7f0000080211000001975050505050"], 0x448}}, 0x4000081) (async, rerun: 32) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r13, r12, 0x0, 0x10000a006) 00:27:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x2}, 0x0) 00:27:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x6) 00:27:04 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 1) [ 654.627535][T15852] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 654.652775][T15854] FAULT_INJECTION: forcing a failure. [ 654.652775][T15854] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 654.684224][T15854] CPU: 1 PID: 15854 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 654.694790][T15854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 654.705054][T15854] Call Trace: [ 654.708354][T15854] [ 654.711298][T15854] dump_stack_lvl+0x125/0x1b0 [ 654.716027][T15854] should_fail_ex+0x496/0x5b0 [ 654.720743][T15854] _copy_from_user+0x30/0xf0 [ 654.725378][T15854] copy_msghdr_from_user+0x99/0x160 [ 654.730807][T15854] ? __copy_msghdr+0x460/0x460 [ 654.735632][T15854] ? find_held_lock+0x2d/0x110 [ 654.740452][T15854] ___sys_sendmsg+0xff/0x1d0 [ 654.745103][T15854] ? do_recvmmsg+0x740/0x740 [ 654.749742][T15854] ? find_held_lock+0x2d/0x110 [ 654.754570][T15854] ? __fget_light+0xe6/0x260 [ 654.759181][T15854] __sys_sendmsg+0x117/0x1e0 [ 654.763879][T15854] ? __sys_sendmsg_sock+0x30/0x30 [ 654.768923][T15854] ? irqentry_enter+0x2d/0x50 [ 654.773617][T15854] ? irqentry_exit+0x3b/0x80 [ 654.778234][T15854] do_syscall_64+0x40/0x110 [ 654.782762][T15854] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 654.788668][T15854] RIP: 0033:0x7f9b1bc7cce9 [ 654.793091][T15854] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 654.812703][T15854] RSP: 002b:00007f9b1c9460c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 654.821132][T15854] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7cce9 00:27:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x7) 00:27:04 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x10, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 654.829112][T15854] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 654.837087][T15854] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 654.845086][T15854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 654.853087][T15854] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 654.861111][T15854] 00:27:04 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x8) 00:27:04 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) write$binfmt_script(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e2f66696c6530202d206367726f75702e636f6e74726f6c6c65727300206e6c383032313100206e6c383032313100206e65745f7072696f2e7072690469647800206367726f75702e636f6e74726f6c6c6572730020407d208a205b0a69c32f863e6eecff6d71bac77281b5ce26a421705e0dcbe30d56e320c50aa4849637edcc01f6232088aaa2405ba8dce4a2fee26dd07a79d3586914f4b8b5e55ab4761d0d1862741dbb2343c0b6816f8684ed618c0d3d5781d308649d08cdbe9d8812247b8df28658d86a58a0976db46f5b889e79f73f9e243b4cf9480156bf2255b2ecda"], 0xe4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r6, r5, 0x0, 0x10000a006) 00:27:04 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x4}, 0x0) [ 655.042771][T15868] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:05 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 2) 00:27:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x60, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xa) 00:27:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x5}, 0x0) 00:27:05 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) write$binfmt_script(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e2f66696c6530202d206367726f75702e636f6e74726f6c6c65727300206e6c383032313100206e6c383032313100206e65745f7072696f2e7072690469647800206367726f75702e636f6e74726f6c6c6572730020407d208a205b0a69c32f863e6eecff6d71bac77281b5ce26a421705e0dcbe30d56e320c50aa4849637edcc01f6232088aaa2405ba8dce4a2fee26dd07a79d3586914f4b8b5e55ab4761d0d1862741dbb2343c0b6816f8684ed618c0d3d5781d308649d08cdbe9d8812247b8df28658d86a58a0976db46f5b889e79f73f9e243b4cf9480156bf2255b2ecda"], 0xe4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r6, r5, 0x0, 0x10000a006) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) write$binfmt_script(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e2f66696c6530202d206367726f75702e636f6e74726f6c6c65727300206e6c383032313100206e6c383032313100206e65745f7072696f2e7072690469647800206367726f75702e636f6e74726f6c6c6572730020407d208a205b0a69c32f863e6eecff6d71bac77281b5ce26a421705e0dcbe30d56e320c50aa4849637edcc01f6232088aaa2405ba8dce4a2fee26dd07a79d3586914f4b8b5e55ab4761d0d1862741dbb2343c0b6816f8684ed618c0d3d5781d308649d08cdbe9d8812247b8df28658d86a58a0976db46f5b889e79f73f9e243b4cf9480156bf2255b2ecda"], 0xe4) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r6, r5, 0x0, 0x10000a006) (async) 00:27:05 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = accept4$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f00000002c0)=0x1c, 0x80800) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) sendfile(r4, r5, 0x0, 0x3) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) sendfile(r1, r2, &(0x7f0000000300)=0x1, 0x9) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r8, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r7, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r11, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r10, r9, 0x0, 0x10000a006) 00:27:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xc) 00:27:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:05 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) write$binfmt_script(r1, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e2f66696c6530202d206367726f75702e636f6e74726f6c6c65727300206e6c383032313100206e6c383032313100206e65745f7072696f2e7072690469647800206367726f75702e636f6e74726f6c6c6572730020407d208a205b0a69c32f863e6eecff6d71bac77281b5ce26a421705e0dcbe30d56e320c50aa4849637edcc01f6232088aaa2405ba8dce4a2fee26dd07a79d3586914f4b8b5e55ab4761d0d1862741dbb2343c0b6816f8684ed618c0d3d5781d308649d08cdbe9d8812247b8df28658d86a58a0976db46f5b889e79f73f9e243b4cf9480156bf2255b2ecda"], 0xe4) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r6, r5, 0x0, 0x10000a006) (async) sendfile(r6, r5, 0x0, 0x10000a006) [ 655.486988][T15880] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 655.507455][T15881] FAULT_INJECTION: forcing a failure. [ 655.507455][T15881] name failslab, interval 1, probability 0, space 0, times 0 00:27:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x7}, 0x0) 00:27:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xe) [ 655.586735][T15881] CPU: 0 PID: 15881 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 655.597225][T15881] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 655.607331][T15881] Call Trace: [ 655.610723][T15881] [ 655.613681][T15881] dump_stack_lvl+0x125/0x1b0 [ 655.618411][T15881] should_fail_ex+0x496/0x5b0 [ 655.623126][T15881] should_failslab+0x9/0x20 [ 655.627678][T15881] kmem_cache_alloc_node+0x71/0x330 [ 655.632923][T15881] ? __alloc_skb+0x287/0x330 [ 655.637568][T15881] __alloc_skb+0x287/0x330 [ 655.642206][T15881] ? __napi_build_skb+0x50/0x50 [ 655.647116][T15881] ? __netlink_dump_start+0x9c0/0x9c0 [ 655.652527][T15881] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 655.658555][T15881] netlink_alloc_large_skb+0x4d/0xf0 [ 655.663877][T15881] netlink_sendmsg+0x688/0xd70 [ 655.668685][T15881] ? netlink_unicast+0x810/0x810 [ 655.673664][T15881] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 655.679001][T15881] ? netlink_unicast+0x810/0x810 [ 655.683956][T15881] __sock_sendmsg+0xd5/0x180 [ 655.688562][T15881] ____sys_sendmsg+0x6ac/0x940 [ 655.693424][T15881] ? copy_msghdr_from_user+0x10b/0x160 [ 655.698901][T15881] ? kernel_sendmsg+0x50/0x50 [ 655.703598][T15881] ? find_held_lock+0x2d/0x110 [ 655.708379][T15881] ___sys_sendmsg+0x135/0x1d0 [ 655.713100][T15881] ? do_recvmmsg+0x740/0x740 [ 655.717730][T15881] ? find_held_lock+0x2d/0x110 [ 655.722568][T15881] ? __fget_light+0xe6/0x260 [ 655.727291][T15881] __sys_sendmsg+0x117/0x1e0 [ 655.731919][T15881] ? __sys_sendmsg_sock+0x30/0x30 [ 655.736999][T15881] ? syscall_enter_from_user_mode+0x7f/0x120 [ 655.743027][T15881] do_syscall_64+0x40/0x110 [ 655.747560][T15881] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 655.753473][T15881] RIP: 0033:0x7f9b1bc7cce9 [ 655.757894][T15881] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 655.777511][T15881] RSP: 002b:00007f9b1c9460c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 655.786020][T15881] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7cce9 [ 655.794002][T15881] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 655.802082][T15881] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 655.810062][T15881] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 655.818038][T15881] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 655.826031][T15881] [ 655.890317][T15894] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0xa}, 0x0) 00:27:05 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 3) 00:27:05 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x300, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:05 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r4 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x541b, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRESDEC=r4, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000025c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0}}) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000001980)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000640)={r6, 0x9, 0x0, [0x2, 0x0, 0x0, 0x400], [0x4, 0x0, 0x0, 0x1, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x8000000000, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffffffffffa, 0x0, 0x200, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000017c0)={0x2, 0x1, {0xb6, @usage=0x4, 0x0, 0x9, 0x1, 0x0, 0x7, 0x1000000fc, 0x0, @struct={0x7fffffff}, 0xffffffff, 0x0, [0x7f, 0x7fffffff, 0x3, 0x0, 0x1, 0x40000003]}, {0x8b, @usage=0x5, 0x0, 0xba, 0x9, 0x5, 0x7, 0x204, 0x44f, @usage=0x5d, 0x5, 0x2, [0xffffffffffff8001, 0x0, 0xfffffffffffffffe, 0x8, 0x7]}, {0x0, @struct={0x0, 0x5}, r6, 0x0, 0xe432, 0x6, 0x0, 0x20, 0x0, @usage, 0x5, 0x4, [0x800000000000002, 0x0, 0x0, 0x1f, 0x8000000000000001, 0xc03]}, {0x0, 0x401}}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000012c0)={0x1e, 0x0, {0x9, @usage, r6, 0x0, 0x0, 0x6, 0xffff, 0x40, 0x0, @usage=0x401, 0x23, 0x8, [0x6, 0x6d56, 0xfffffffffffffffc, 0x7fff, 0x7c4e, 0x8]}, {0x5, @struct={0x4, 0x5}, 0x0, 0x9, 0x7fffffffffffffff, 0x100000000, 0x0, 0xfffffffffffffffe, 0x80, @usage=0x5, 0xffffffff, 0x8, [0x5, 0xfffffffffffffff9, 0x5f9, 0x5564]}, {0xffffffffffffffff, @struct={0x8000, 0x9}, r6, 0xa644, 0x4, 0x40, 0x0, 0x0, 0x0, @struct={0x0, 0x7e0}, 0x6, 0xc227, [0xb3ea, 0x0, 0x401, 0x2]}, {0xd36}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000001bc0)={0x0, 0x81, 0x1000, 0x1}) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000580)={r6, "7e1d7e910700"}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000000480)={0x3, 0x0, {0x6, @usage=0x10001, 0x0, 0x40000, 0x42a, 0x1, 0xb31f, 0x7, 0x4b8, @usage=0x3, 0x2, 0x9, [0xffffffff7fffffff, 0x1f, 0x6, 0x401, 0x0, 0xed]}, {0x0, @struct={0x0, 0xfffffffa}, r6, 0x201, 0xffffffffffffff7f, 0x9a6, 0xd0, 0x4, 0x79, @struct={0x6}, 0x0, 0xb0, [0x3, 0x80000001, 0x8000000000800001, 0x1, 0x8000, 0xfffffffffffffff8]}, {0x3ff, @usage=0xfff, 0x0, 0x7c2, 0x0, 0x264, 0x0, 0x101, 0x52, @struct={0x6, 0x1f}, 0x8, 0x5, [0x4, 0x0, 0x9, 0x800, 0x4, 0x3]}, {0x100000000, 0x2be, 0x6ee000}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000240)={r6, 0xffffffffffffff81, 0x0, [0x100, 0x8, 0x80f], [0x3, 0xe53, 0x3, 0x1, 0x3, 0x8, 0x3, 0x7f, 0x40, 0x8000000000000001, 0xffffffffffffffff, 0x0, 0x1c0000, 0x2, 0xfffffffe, 0x3, 0xffffffffffffffe0, 0x816, 0x0, 0x5, 0x6, 0x1e, 0x1, 0x7fffffff, 0x7, 0x25ce, 0xffffffffffffffff, 0x7fffffffffffffff, 0x7fffffff, 0x5d760b8a, 0x400, 0xf5a0, 0x1, 0x100000001, 0x4, 0x86, 0x40, 0x8, 0x0, 0x8, 0x4, 0x400, 0x9, 0x8, 0x2, 0x8, 0x3, 0x8001, 0x9, 0x1, 0xffffffffffffffff, 0x4, 0xffff, 0x6, 0x3, 0x1, 0x0, 0x2, 0x4, 0xffffffffffffffff, 0x8001, 0x8, 0xe28d, 0x100, 0x81, 0x1ff, 0x44, 0x3, 0x6, 0x9, 0x0, 0x1f, 0x1, 0x9, 0x8, 0x80000001, 0x8001, 0x4acf, 0x40, 0x8, 0x6, 0xffffffffffffff7f, 0x0, 0x6, 0x8, 0x10001, 0x1f, 0x7, 0x896, 0x7fffffffffffffff, 0x10000, 0x88, 0x0, 0xf9e5, 0x4, 0x5, 0x8, 0x101, 0x90, 0x6, 0x5, 0xa5, 0xffffffffffffff7f, 0x2d, 0x3, 0x1, 0x8000000000000001, 0x2d, 0x400, 0x1, 0x100000001, 0x4, 0x2, 0x0, 0x5, 0x0, 0x9, 0x80000000, 0x7, 0x724, 0x1]}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000001800)={0x5, 0x0, {0x47a, @usage=0x6, 0x0, 0x586, 0x6, 0x22, 0x8000, 0x2, 0x8, @usage=0x8974, 0x2a3d, 0x0, [0x7, 0x405, 0x7f, 0x8, 0x3, 0x5]}, {0x0, @struct={0x2, 0x2}, r6, 0x80000001, 0x7fffffffffffffff, 0x100000000, 0x3, 0x2, 0x8, @usage=0x6, 0xb0, 0x5, [0x9, 0x2, 0x8, 0x4, 0x200000, 0xe8]}, {0x7fffffff, @usage=0x8000, 0x0, 0x200, 0x7, 0x8001, 0x7ff, 0x0, 0x20, @usage=0x450ed59b, 0x4, 0x6, [0x3, 0x5, 0x9, 0x7, 0xff, 0x8]}, {0xffff, 0xffffffffffffffff, 0x2}}) ioctl$BTRFS_IOC_RESIZE(0xffffffffffffffff, 0x50009403, &(0x7f0000000040)={{}, {@val={r6}, @max}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r5, 0x0, 0x10000a006) 00:27:05 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf) 00:27:05 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x10}, 0x0) [ 656.042028][T15900] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 656.179345][T15906] netlink: 'syz-executor.5': attribute type 10 has an invalid length. 00:27:06 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = accept4$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f00000002c0)=0x1c, 0x80800) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) (async) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) sendfile(r4, r5, 0x0, 0x3) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) sendfile(r1, r2, &(0x7f0000000300)=0x1, 0x9) (async) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r8, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r7, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r11, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r10, r9, 0x0, 0x10000a006) 00:27:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x10) 00:27:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x369, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:06 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 4) 00:27:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x25}, 0x0) 00:27:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x500, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x60) [ 656.469627][T15915] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 656.501181][T15913] FAULT_INJECTION: forcing a failure. [ 656.501181][T15913] name fail_usercopy, interval 1, probability 0, space 0, times 0 00:27:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x118}, 0x0) [ 656.541320][T15913] CPU: 0 PID: 15913 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 656.551899][T15913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 656.561995][T15913] Call Trace: [ 656.565311][T15913] [ 656.568280][T15913] dump_stack_lvl+0x125/0x1b0 [ 656.573020][T15913] should_fail_ex+0x496/0x5b0 [ 656.577770][T15913] _copy_from_iter+0x246/0x10f0 [ 656.582683][T15913] ? __alloc_skb+0x1c5/0x330 [ 656.587318][T15913] ? page_copy_sane+0x2c0/0x2c0 [ 656.592221][T15913] ? __napi_build_skb+0x50/0x50 [ 656.597122][T15913] ? __netlink_dump_start+0x9c0/0x9c0 [ 656.602533][T15913] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 656.608489][T15913] ? __virt_addr_valid+0x5e/0x2d0 [ 656.613565][T15913] ? __phys_addr_symbol+0x30/0x70 [ 656.618646][T15913] ? __check_object_size+0x323/0x730 [ 656.624022][T15913] netlink_sendmsg+0x812/0xd70 [ 656.628846][T15913] ? netlink_unicast+0x810/0x810 [ 656.633833][T15913] ? bpf_lsm_socket_sendmsg+0x9/0x10 00:27:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x600, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 656.636566][T15923] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 656.639150][T15913] ? netlink_unicast+0x810/0x810 [ 656.639187][T15913] __sock_sendmsg+0xd5/0x180 [ 656.639230][T15913] ____sys_sendmsg+0x6ac/0x940 [ 656.639262][T15913] ? copy_msghdr_from_user+0x10b/0x160 [ 656.639297][T15913] ? kernel_sendmsg+0x50/0x50 [ 656.671941][T15913] ? find_held_lock+0x2d/0x110 [ 656.676773][T15913] ___sys_sendmsg+0x135/0x1d0 [ 656.681543][T15913] ? do_recvmmsg+0x740/0x740 [ 656.686192][T15913] ? find_held_lock+0x2d/0x110 [ 656.691048][T15913] ? __fget_light+0xe6/0x260 [ 656.695692][T15913] __sys_sendmsg+0x117/0x1e0 [ 656.700347][T15913] ? __sys_sendmsg_sock+0x30/0x30 [ 656.705459][T15913] ? syscall_enter_from_user_mode+0x7f/0x120 [ 656.711498][T15913] do_syscall_64+0x40/0x110 [ 656.716064][T15913] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 656.722015][T15913] RIP: 0033:0x7f9b1bc7cce9 [ 656.726464][T15913] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 656.746118][T15913] RSP: 002b:00007f9b1c9460c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 656.754581][T15913] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7cce9 [ 656.762598][T15913] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 656.770610][T15913] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 656.778619][T15913] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 656.786647][T15913] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 656.794830][T15913] 00:27:06 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async, rerun: 64) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) (rerun: 64) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async, rerun: 64) r4 = socket$igmp(0x2, 0x3, 0x2) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x541b, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRESDEC=r4, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async, rerun: 64) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) (async, rerun: 32) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) (async, rerun: 32) shutdown(0xffffffffffffffff, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000025c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0}}) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000001980)) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000640)={r6, 0x9, 0x0, [0x2, 0x0, 0x0, 0x400], [0x4, 0x0, 0x0, 0x1, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x8000000000, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffffffffffa, 0x0, 0x200, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000017c0)={0x2, 0x1, {0xb6, @usage=0x4, 0x0, 0x9, 0x1, 0x0, 0x7, 0x1000000fc, 0x0, @struct={0x7fffffff}, 0xffffffff, 0x0, [0x7f, 0x7fffffff, 0x3, 0x0, 0x1, 0x40000003]}, {0x8b, @usage=0x5, 0x0, 0xba, 0x9, 0x5, 0x7, 0x204, 0x44f, @usage=0x5d, 0x5, 0x2, [0xffffffffffff8001, 0x0, 0xfffffffffffffffe, 0x8, 0x7]}, {0x0, @struct={0x0, 0x5}, r6, 0x0, 0xe432, 0x6, 0x0, 0x20, 0x0, @usage, 0x5, 0x4, [0x800000000000002, 0x0, 0x0, 0x1f, 0x8000000000000001, 0xc03]}, {0x0, 0x401}}) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000012c0)={0x1e, 0x0, {0x9, @usage, r6, 0x0, 0x0, 0x6, 0xffff, 0x40, 0x0, @usage=0x401, 0x23, 0x8, [0x6, 0x6d56, 0xfffffffffffffffc, 0x7fff, 0x7c4e, 0x8]}, {0x5, @struct={0x4, 0x5}, 0x0, 0x9, 0x7fffffffffffffff, 0x100000000, 0x0, 0xfffffffffffffffe, 0x80, @usage=0x5, 0xffffffff, 0x8, [0x5, 0xfffffffffffffff9, 0x5f9, 0x5564]}, {0xffffffffffffffff, @struct={0x8000, 0x9}, r6, 0xa644, 0x4, 0x40, 0x0, 0x0, 0x0, @struct={0x0, 0x7e0}, 0x6, 0xc227, [0xb3ea, 0x0, 0x401, 0x2]}, {0xd36}}) (async) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000001bc0)={0x0, 0x81, 0x1000, 0x1}) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000580)={r6, "7e1d7e910700"}) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000000480)={0x3, 0x0, {0x6, @usage=0x10001, 0x0, 0x40000, 0x42a, 0x1, 0xb31f, 0x7, 0x4b8, @usage=0x3, 0x2, 0x9, [0xffffffff7fffffff, 0x1f, 0x6, 0x401, 0x0, 0xed]}, {0x0, @struct={0x0, 0xfffffffa}, r6, 0x201, 0xffffffffffffff7f, 0x9a6, 0xd0, 0x4, 0x79, @struct={0x6}, 0x0, 0xb0, [0x3, 0x80000001, 0x8000000000800001, 0x1, 0x8000, 0xfffffffffffffff8]}, {0x3ff, @usage=0xfff, 0x0, 0x7c2, 0x0, 0x264, 0x0, 0x101, 0x52, @struct={0x6, 0x1f}, 0x8, 0x5, [0x4, 0x0, 0x9, 0x800, 0x4, 0x3]}, {0x100000000, 0x2be, 0x6ee000}}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000240)={r6, 0xffffffffffffff81, 0x0, [0x100, 0x8, 0x80f], [0x3, 0xe53, 0x3, 0x1, 0x3, 0x8, 0x3, 0x7f, 0x40, 0x8000000000000001, 0xffffffffffffffff, 0x0, 0x1c0000, 0x2, 0xfffffffe, 0x3, 0xffffffffffffffe0, 0x816, 0x0, 0x5, 0x6, 0x1e, 0x1, 0x7fffffff, 0x7, 0x25ce, 0xffffffffffffffff, 0x7fffffffffffffff, 0x7fffffff, 0x5d760b8a, 0x400, 0xf5a0, 0x1, 0x100000001, 0x4, 0x86, 0x40, 0x8, 0x0, 0x8, 0x4, 0x400, 0x9, 0x8, 0x2, 0x8, 0x3, 0x8001, 0x9, 0x1, 0xffffffffffffffff, 0x4, 0xffff, 0x6, 0x3, 0x1, 0x0, 0x2, 0x4, 0xffffffffffffffff, 0x8001, 0x8, 0xe28d, 0x100, 0x81, 0x1ff, 0x44, 0x3, 0x6, 0x9, 0x0, 0x1f, 0x1, 0x9, 0x8, 0x80000001, 0x8001, 0x4acf, 0x40, 0x8, 0x6, 0xffffffffffffff7f, 0x0, 0x6, 0x8, 0x10001, 0x1f, 0x7, 0x896, 0x7fffffffffffffff, 0x10000, 0x88, 0x0, 0xf9e5, 0x4, 0x5, 0x8, 0x101, 0x90, 0x6, 0x5, 0xa5, 0xffffffffffffff7f, 0x2d, 0x3, 0x1, 0x8000000000000001, 0x2d, 0x400, 0x1, 0x100000001, 0x4, 0x2, 0x0, 0x5, 0x0, 0x9, 0x80000000, 0x7, 0x724, 0x1]}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000001800)={0x5, 0x0, {0x47a, @usage=0x6, 0x0, 0x586, 0x6, 0x22, 0x8000, 0x2, 0x8, @usage=0x8974, 0x2a3d, 0x0, [0x7, 0x405, 0x7f, 0x8, 0x3, 0x5]}, {0x0, @struct={0x2, 0x2}, r6, 0x80000001, 0x7fffffffffffffff, 0x100000000, 0x3, 0x2, 0x8, @usage=0x6, 0xb0, 0x5, [0x9, 0x2, 0x8, 0x4, 0x200000, 0xe8]}, {0x7fffffff, @usage=0x8000, 0x0, 0x200, 0x7, 0x8001, 0x7ff, 0x0, 0x20, @usage=0x450ed59b, 0x4, 0x6, [0x3, 0x5, 0x9, 0x7, 0xff, 0x8]}, {0xffff, 0xffffffffffffffff, 0x2}}) (async) ioctl$BTRFS_IOC_RESIZE(0xffffffffffffffff, 0x50009403, &(0x7f0000000040)={{}, {@val={r6}, @max}}) (async, rerun: 64) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r7, r5, 0x0, 0x10000a006) 00:27:06 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x300}, 0x0) 00:27:06 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf0) 00:27:06 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x700, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:06 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 5) 00:27:06 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (rerun: 64) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = accept4$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, &(0x7f00000002c0)=0x1c, 0x80800) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) (async) r5 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) sendfile(r4, r5, 0x0, 0x3) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async, rerun: 32) sendfile(r1, r2, &(0x7f0000000300)=0x1, 0x9) (async, rerun: 32) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r8, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r7, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r11, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r10, r9, 0x0, 0x10000a006) [ 657.059753][T15934] netlink: 'syz-executor.5': attribute type 10 has an invalid length. [ 657.094937][T15935] FAULT_INJECTION: forcing a failure. [ 657.094937][T15935] name failslab, interval 1, probability 0, space 0, times 0 [ 657.119467][T15935] CPU: 0 PID: 15935 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 657.129954][T15935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 657.140042][T15935] Call Trace: [ 657.143328][T15935] [ 657.146263][T15935] dump_stack_lvl+0x125/0x1b0 [ 657.150968][T15935] should_fail_ex+0x496/0x5b0 [ 657.155660][T15935] should_failslab+0x9/0x20 [ 657.160182][T15935] __kmem_cache_alloc_node+0x6b/0x310 [ 657.165574][T15935] ? rtnl_newlink+0x49/0xa0 [ 657.170104][T15935] kmalloc_trace+0x25/0x60 [ 657.174544][T15935] rtnl_newlink+0x49/0xa0 [ 657.178988][T15935] ? __rtnl_newlink+0x1940/0x1940 [ 657.184031][T15935] rtnetlink_rcv_msg+0x3c7/0xe00 [ 657.188991][T15935] ? rtnl_fill_vf+0x490/0x490 [ 657.193691][T15935] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 657.199694][T15935] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 657.205703][T15935] netlink_rcv_skb+0x16b/0x440 [ 657.210476][T15935] ? rtnl_fill_vf+0x490/0x490 [ 657.215169][T15935] ? netlink_ack+0x1380/0x1380 [ 657.219937][T15935] ? lock_sync+0x190/0x190 [ 657.224394][T15935] ? netlink_deliver_tap+0x1a0/0xd00 [ 657.229710][T15935] ? _copy_from_iter+0x2c1/0x10f0 [ 657.234863][T15935] netlink_unicast+0x53b/0x810 [ 657.239643][T15935] ? netlink_attachskb+0x880/0x880 [ 657.244766][T15935] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 657.250675][T15935] ? __phys_addr_symbol+0x30/0x70 [ 657.255714][T15935] ? __check_object_size+0x323/0x730 [ 657.261019][T15935] netlink_sendmsg+0x8b7/0xd70 [ 657.265798][T15935] ? netlink_unicast+0x810/0x810 [ 657.270765][T15935] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 657.276159][T15935] ? netlink_unicast+0x810/0x810 [ 657.281200][T15935] __sock_sendmsg+0xd5/0x180 [ 657.285810][T15935] ____sys_sendmsg+0x6ac/0x940 [ 657.290595][T15935] ? copy_msghdr_from_user+0x10b/0x160 [ 657.296071][T15935] ? kernel_sendmsg+0x50/0x50 [ 657.300770][T15935] ? find_held_lock+0x2d/0x110 [ 657.305556][T15935] ___sys_sendmsg+0x135/0x1d0 [ 657.310255][T15935] ? do_recvmmsg+0x740/0x740 [ 657.314863][T15935] ? find_held_lock+0x2d/0x110 [ 657.319673][T15935] ? __fget_light+0xe6/0x260 [ 657.324278][T15935] __sys_sendmsg+0x117/0x1e0 [ 657.328888][T15935] ? __sys_sendmsg_sock+0x30/0x30 [ 657.334038][T15935] ? syscall_enter_from_user_mode+0x7f/0x120 [ 657.340040][T15935] do_syscall_64+0x40/0x110 [ 657.344563][T15935] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 657.350471][T15935] RIP: 0033:0x7f9b1bc7cce9 [ 657.354894][T15935] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 657.374597][T15935] RSP: 002b:00007f9b1c9460c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 657.383026][T15935] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7cce9 [ 657.391006][T15935] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 657.398984][T15935] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 657.406968][T15935] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 657.414942][T15935] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 657.422947][T15935] 00:27:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x324}, 0x0) 00:27:07 executing program 0: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_ro(r2, &(0x7f00000001c0)='memory.numa_stat\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r5, &(0x7f0000000440)=[{&(0x7f0000000080)=""/124, 0x7c}, {&(0x7f00000002c0)=""/149, 0x95}, {&(0x7f0000000380)=""/190, 0xbe}], 0x3, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r9, r8, 0x0, 0x10000a006) 00:27:07 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x900, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:07 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 6) 00:27:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x300) 00:27:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x336}, 0x0) 00:27:07 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$igmp(0x2, 0x3, 0x2) (async) r4 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x541b, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x541b, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRESDEC=r4, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYRESDEC=r4, @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000025c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) (async) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, &(0x7f00000025c0)={0x0, 0x0, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @usage, 0x0}}) ioctl$sock_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000001980)) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000640)={r6, 0x9, 0x0, [0x2, 0x0, 0x0, 0x400], [0x4, 0x0, 0x0, 0x1, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x8000000000, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffffffffffa, 0x0, 0x200, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000640)={r6, 0x9, 0x0, [0x2, 0x0, 0x0, 0x400], [0x4, 0x0, 0x0, 0x1, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x400, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7, 0x0, 0x8000000000, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffffffffffa, 0x0, 0x200, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000]}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000017c0)={0x2, 0x1, {0xb6, @usage=0x4, 0x0, 0x9, 0x1, 0x0, 0x7, 0x1000000fc, 0x0, @struct={0x7fffffff}, 0xffffffff, 0x0, [0x7f, 0x7fffffff, 0x3, 0x0, 0x1, 0x40000003]}, {0x8b, @usage=0x5, 0x0, 0xba, 0x9, 0x5, 0x7, 0x204, 0x44f, @usage=0x5d, 0x5, 0x2, [0xffffffffffff8001, 0x0, 0xfffffffffffffffe, 0x8, 0x7]}, {0x0, @struct={0x0, 0x5}, r6, 0x0, 0xe432, 0x6, 0x0, 0x20, 0x0, @usage, 0x5, 0x4, [0x800000000000002, 0x0, 0x0, 0x1f, 0x8000000000000001, 0xc03]}, {0x0, 0x401}}) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000017c0)={0x2, 0x1, {0xb6, @usage=0x4, 0x0, 0x9, 0x1, 0x0, 0x7, 0x1000000fc, 0x0, @struct={0x7fffffff}, 0xffffffff, 0x0, [0x7f, 0x7fffffff, 0x3, 0x0, 0x1, 0x40000003]}, {0x8b, @usage=0x5, 0x0, 0xba, 0x9, 0x5, 0x7, 0x204, 0x44f, @usage=0x5d, 0x5, 0x2, [0xffffffffffff8001, 0x0, 0xfffffffffffffffe, 0x8, 0x7]}, {0x0, @struct={0x0, 0x5}, r6, 0x0, 0xe432, 0x6, 0x0, 0x20, 0x0, @usage, 0x5, 0x4, [0x800000000000002, 0x0, 0x0, 0x1f, 0x8000000000000001, 0xc03]}, {0x0, 0x401}}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000012c0)={0x1e, 0x0, {0x9, @usage, r6, 0x0, 0x0, 0x6, 0xffff, 0x40, 0x0, @usage=0x401, 0x23, 0x8, [0x6, 0x6d56, 0xfffffffffffffffc, 0x7fff, 0x7c4e, 0x8]}, {0x5, @struct={0x4, 0x5}, 0x0, 0x9, 0x7fffffffffffffff, 0x100000000, 0x0, 0xfffffffffffffffe, 0x80, @usage=0x5, 0xffffffff, 0x8, [0x5, 0xfffffffffffffff9, 0x5f9, 0x5564]}, {0xffffffffffffffff, @struct={0x8000, 0x9}, r6, 0xa644, 0x4, 0x40, 0x0, 0x0, 0x0, @struct={0x0, 0x7e0}, 0x6, 0xc227, [0xb3ea, 0x0, 0x401, 0x2]}, {0xd36}}) (async) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f00000012c0)={0x1e, 0x0, {0x9, @usage, r6, 0x0, 0x0, 0x6, 0xffff, 0x40, 0x0, @usage=0x401, 0x23, 0x8, [0x6, 0x6d56, 0xfffffffffffffffc, 0x7fff, 0x7c4e, 0x8]}, {0x5, @struct={0x4, 0x5}, 0x0, 0x9, 0x7fffffffffffffff, 0x100000000, 0x0, 0xfffffffffffffffe, 0x80, @usage=0x5, 0xffffffff, 0x8, [0x5, 0xfffffffffffffff9, 0x5f9, 0x5564]}, {0xffffffffffffffff, @struct={0x8000, 0x9}, r6, 0xa644, 0x4, 0x40, 0x0, 0x0, 0x0, @struct={0x0, 0x7e0}, 0x6, 0xc227, [0xb3ea, 0x0, 0x401, 0x2]}, {0xd36}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(0xffffffffffffffff, 0xc400941d, &(0x7f0000001bc0)={0x0, 0x81, 0x1000, 0x1}) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000580)={r6, "7e1d7e910700"}) (async) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000580)={r6, "7e1d7e910700"}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000000480)={0x3, 0x0, {0x6, @usage=0x10001, 0x0, 0x40000, 0x42a, 0x1, 0xb31f, 0x7, 0x4b8, @usage=0x3, 0x2, 0x9, [0xffffffff7fffffff, 0x1f, 0x6, 0x401, 0x0, 0xed]}, {0x0, @struct={0x0, 0xfffffffa}, r6, 0x201, 0xffffffffffffff7f, 0x9a6, 0xd0, 0x4, 0x79, @struct={0x6}, 0x0, 0xb0, [0x3, 0x80000001, 0x8000000000800001, 0x1, 0x8000, 0xfffffffffffffff8]}, {0x3ff, @usage=0xfff, 0x0, 0x7c2, 0x0, 0x264, 0x0, 0x101, 0x52, @struct={0x6, 0x1f}, 0x8, 0x5, [0x4, 0x0, 0x9, 0x800, 0x4, 0x3]}, {0x100000000, 0x2be, 0x6ee000}}) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000240)={r6, 0xffffffffffffff81, 0x0, [0x100, 0x8, 0x80f], [0x3, 0xe53, 0x3, 0x1, 0x3, 0x8, 0x3, 0x7f, 0x40, 0x8000000000000001, 0xffffffffffffffff, 0x0, 0x1c0000, 0x2, 0xfffffffe, 0x3, 0xffffffffffffffe0, 0x816, 0x0, 0x5, 0x6, 0x1e, 0x1, 0x7fffffff, 0x7, 0x25ce, 0xffffffffffffffff, 0x7fffffffffffffff, 0x7fffffff, 0x5d760b8a, 0x400, 0xf5a0, 0x1, 0x100000001, 0x4, 0x86, 0x40, 0x8, 0x0, 0x8, 0x4, 0x400, 0x9, 0x8, 0x2, 0x8, 0x3, 0x8001, 0x9, 0x1, 0xffffffffffffffff, 0x4, 0xffff, 0x6, 0x3, 0x1, 0x0, 0x2, 0x4, 0xffffffffffffffff, 0x8001, 0x8, 0xe28d, 0x100, 0x81, 0x1ff, 0x44, 0x3, 0x6, 0x9, 0x0, 0x1f, 0x1, 0x9, 0x8, 0x80000001, 0x8001, 0x4acf, 0x40, 0x8, 0x6, 0xffffffffffffff7f, 0x0, 0x6, 0x8, 0x10001, 0x1f, 0x7, 0x896, 0x7fffffffffffffff, 0x10000, 0x88, 0x0, 0xf9e5, 0x4, 0x5, 0x8, 0x101, 0x90, 0x6, 0x5, 0xa5, 0xffffffffffffff7f, 0x2d, 0x3, 0x1, 0x8000000000000001, 0x2d, 0x400, 0x1, 0x100000001, 0x4, 0x2, 0x0, 0x5, 0x0, 0x9, 0x80000000, 0x7, 0x724, 0x1]}) (async) ioctl$BTRFS_IOC_GET_DEV_STATS(0xffffffffffffffff, 0xc4089434, &(0x7f0000000240)={r6, 0xffffffffffffff81, 0x0, [0x100, 0x8, 0x80f], [0x3, 0xe53, 0x3, 0x1, 0x3, 0x8, 0x3, 0x7f, 0x40, 0x8000000000000001, 0xffffffffffffffff, 0x0, 0x1c0000, 0x2, 0xfffffffe, 0x3, 0xffffffffffffffe0, 0x816, 0x0, 0x5, 0x6, 0x1e, 0x1, 0x7fffffff, 0x7, 0x25ce, 0xffffffffffffffff, 0x7fffffffffffffff, 0x7fffffff, 0x5d760b8a, 0x400, 0xf5a0, 0x1, 0x100000001, 0x4, 0x86, 0x40, 0x8, 0x0, 0x8, 0x4, 0x400, 0x9, 0x8, 0x2, 0x8, 0x3, 0x8001, 0x9, 0x1, 0xffffffffffffffff, 0x4, 0xffff, 0x6, 0x3, 0x1, 0x0, 0x2, 0x4, 0xffffffffffffffff, 0x8001, 0x8, 0xe28d, 0x100, 0x81, 0x1ff, 0x44, 0x3, 0x6, 0x9, 0x0, 0x1f, 0x1, 0x9, 0x8, 0x80000001, 0x8001, 0x4acf, 0x40, 0x8, 0x6, 0xffffffffffffff7f, 0x0, 0x6, 0x8, 0x10001, 0x1f, 0x7, 0x896, 0x7fffffffffffffff, 0x10000, 0x88, 0x0, 0xf9e5, 0x4, 0x5, 0x8, 0x101, 0x90, 0x6, 0x5, 0xa5, 0xffffffffffffff7f, 0x2d, 0x3, 0x1, 0x8000000000000001, 0x2d, 0x400, 0x1, 0x100000001, 0x4, 0x2, 0x0, 0x5, 0x0, 0x9, 0x80000000, 0x7, 0x724, 0x1]}) ioctl$BTRFS_IOC_BALANCE_V2(0xffffffffffffffff, 0xc4009420, &(0x7f0000001800)={0x5, 0x0, {0x47a, @usage=0x6, 0x0, 0x586, 0x6, 0x22, 0x8000, 0x2, 0x8, @usage=0x8974, 0x2a3d, 0x0, [0x7, 0x405, 0x7f, 0x8, 0x3, 0x5]}, {0x0, @struct={0x2, 0x2}, r6, 0x80000001, 0x7fffffffffffffff, 0x100000000, 0x3, 0x2, 0x8, @usage=0x6, 0xb0, 0x5, [0x9, 0x2, 0x8, 0x4, 0x200000, 0xe8]}, {0x7fffffff, @usage=0x8000, 0x0, 0x200, 0x7, 0x8001, 0x7ff, 0x0, 0x20, @usage=0x450ed59b, 0x4, 0x6, [0x3, 0x5, 0x9, 0x7, 0xff, 0x8]}, {0xffff, 0xffffffffffffffff, 0x2}}) ioctl$BTRFS_IOC_RESIZE(0xffffffffffffffff, 0x50009403, &(0x7f0000000040)={{}, {@val={r6}, @max}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r5, 0x0, 0x10000a006) [ 657.752016][T15956] FAULT_INJECTION: forcing a failure. [ 657.752016][T15956] name failslab, interval 1, probability 0, space 0, times 0 [ 657.780395][ T28] kauditd_printk_skb: 30 callbacks suppressed [ 657.780412][ T28] audit: type=1804 audit(1704328027.433:2243): pid=15958 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/919/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 [ 657.794593][T15956] CPU: 0 PID: 15956 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 657.824170][T15956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 657.834233][T15956] Call Trace: [ 657.837525][T15956] [ 657.840469][T15956] dump_stack_lvl+0x125/0x1b0 [ 657.845179][T15956] should_fail_ex+0x496/0x5b0 [ 657.849868][T15956] should_failslab+0x9/0x20 [ 657.854389][T15956] kmem_cache_alloc_node+0x71/0x330 [ 657.859611][T15956] ? __alloc_skb+0x287/0x330 [ 657.864227][T15956] __alloc_skb+0x287/0x330 [ 657.868665][T15956] ? __napi_build_skb+0x50/0x50 [ 657.873543][T15956] netlink_ack+0x3bb/0x1380 [ 657.878058][T15956] ? rtnl_fill_vf+0x490/0x490 [ 657.882769][T15956] ? netlink_sendmsg+0xd70/0xd70 [ 657.887717][T15956] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 657.893735][T15956] netlink_rcv_skb+0x345/0x440 [ 657.898513][T15956] ? rtnl_fill_vf+0x490/0x490 [ 657.903223][T15956] ? netlink_ack+0x1380/0x1380 [ 657.907997][T15956] ? lock_sync+0x190/0x190 [ 657.912448][T15956] ? netlink_deliver_tap+0x1a0/0xd00 [ 657.917753][T15956] ? _copy_from_iter+0x2c1/0x10f0 [ 657.922808][T15956] netlink_unicast+0x53b/0x810 [ 657.927583][T15956] ? netlink_attachskb+0x880/0x880 [ 657.932704][T15956] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 657.938613][T15956] ? __phys_addr_symbol+0x30/0x70 [ 657.943655][T15956] ? __check_object_size+0x323/0x730 [ 657.948960][T15956] netlink_sendmsg+0x8b7/0xd70 [ 657.953743][T15956] ? netlink_unicast+0x810/0x810 [ 657.958696][T15956] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 657.963999][T15956] ? netlink_unicast+0x810/0x810 [ 657.968946][T15956] __sock_sendmsg+0xd5/0x180 [ 657.973563][T15956] ____sys_sendmsg+0x6ac/0x940 [ 657.978342][T15956] ? copy_msghdr_from_user+0x10b/0x160 [ 657.983821][T15956] ? kernel_sendmsg+0x50/0x50 [ 657.988526][T15956] ? find_held_lock+0x2d/0x110 [ 657.993317][T15956] ___sys_sendmsg+0x135/0x1d0 [ 657.998033][T15956] ? do_recvmmsg+0x740/0x740 [ 658.002651][T15956] ? find_held_lock+0x2d/0x110 [ 658.007469][T15956] ? __fget_light+0xe6/0x260 [ 658.012076][T15956] __sys_sendmsg+0x117/0x1e0 [ 658.016685][T15956] ? __sys_sendmsg_sock+0x30/0x30 [ 658.021830][T15956] ? syscall_enter_from_user_mode+0x7f/0x120 [ 658.027831][T15956] do_syscall_64+0x40/0x110 [ 658.032351][T15956] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 658.038257][T15956] RIP: 0033:0x7f9b1bc7cce9 [ 658.042687][T15956] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 658.062299][T15956] RSP: 002b:00007f9b1c9460c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 658.070724][T15956] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7cce9 [ 658.078715][T15956] RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 [ 658.086688][T15956] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 658.094664][T15956] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 658.102638][T15956] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 658.110639][T15956] 00:27:07 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x339}, 0x0) 00:27:07 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xa00, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:07 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xc00, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:07 executing program 0: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) (async, rerun: 64) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (rerun: 64) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_ro(r2, &(0x7f00000001c0)='memory.numa_stat\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async, rerun: 32) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 32) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r5, &(0x7f0000000440)=[{&(0x7f0000000080)=""/124, 0x7c}, {&(0x7f00000002c0)=""/149, 0x95}, {&(0x7f0000000380)=""/190, 0xbe}], 0x3, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r9, r8, 0x0, 0x10000a006) 00:27:07 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xe00, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:07 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x326) 00:27:07 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 7) 00:27:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1f12d}, 0x0) 00:27:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf00, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:08 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) (fail_nth: 8) [ 658.455713][ T28] audit: type=1804 audit(1704328028.103:2244): pid=15978 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/920/cgroup.controllers" dev="sda1" ino=1968 res=1 errno=0 00:27:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x7ffffff2}, 0x0) [ 658.570842][T15985] FAULT_INJECTION: forcing a failure. [ 658.570842][T15985] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 658.625653][T15985] CPU: 1 PID: 15985 Comm: syz-executor.3 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 658.636137][T15985] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 658.646229][T15985] Call Trace: [ 658.649530][T15985] [ 658.652479][T15985] dump_stack_lvl+0x125/0x1b0 [ 658.657216][T15985] should_fail_ex+0x496/0x5b0 [ 658.661963][T15985] _copy_to_user+0x30/0xb0 [ 658.666427][T15985] simple_read_from_buffer+0xd0/0x160 00:27:08 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_type(r1, &(0x7f0000000000), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r4, 0x408, 0x0, 0x0, {0x1c}}, 0x14}, 0x1, 0xf000000}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'rose0\x00'}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)={0x8e, r4, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x583}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'cgroup.type\x00'}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x400}, @ETHTOOL_A_BITSET_BIT_INDEX={0xff43}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00R\x11\xab\x83\x03'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x28}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x8001}]}, {}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '(%.\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\xfb'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE]}]}, @ETHTOOL_A_BITSET_NOMASK, @ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "1c0fd1897a6f57e23a7fcf09eaa8ad8418d907758616"}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x4000881) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x40, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010101}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x40}}, 0x20004000) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={0xffffffffffffffff}, 0x1, 0x0, 0x0, 0x24000000}, 0x4840) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r9, r8, 0x0, 0x10000a006) [ 658.671856][T15985] proc_fail_nth_read+0x1b0/0x280 [ 658.676934][T15985] ? proc_fault_inject_read+0x280/0x280 [ 658.682530][T15985] ? security_file_permission+0xdc/0x100 [ 658.688216][T15985] ? proc_fault_inject_read+0x280/0x280 [ 658.693816][T15985] vfs_read+0x1ce/0x8f0 [ 658.698016][T15985] ? __fdget_pos+0xe7/0x170 [ 658.702609][T15985] ? kernel_read+0x1b0/0x1b0 [ 658.707255][T15985] ? mutex_trylock+0x130/0x130 [ 658.712085][T15985] ? __fget_files+0x1c6/0x340 [ 658.716817][T15985] ksys_read+0x12f/0x250 [ 658.721115][T15985] ? vfs_write+0xdf0/0xdf0 [ 658.725579][T15985] ? syscall_enter_from_user_mode+0x7f/0x120 [ 658.731614][T15985] do_syscall_64+0x40/0x110 [ 658.736148][T15985] entry_SYSCALL_64_after_hwframe+0x63/0x6b [ 658.742060][T15985] RIP: 0033:0x7f9b1bc7b98c [ 658.746480][T15985] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 59 81 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 af 81 02 00 48 [ 658.766098][T15985] RSP: 002b:00007f9b1c9460c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 658.774530][T15985] RAX: ffffffffffffffda RBX: 00007f9b1bd9bf80 RCX: 00007f9b1bc7b98c [ 658.782509][T15985] RDX: 000000000000000f RSI: 00007f9b1c946130 RDI: 0000000000000004 [ 658.790483][T15985] RBP: 00007f9b1c946120 R08: 0000000000000000 R09: 0000000000000000 [ 658.798457][T15985] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 658.806443][T15985] R13: 000000000000000b R14: 00007f9b1bd9bf80 R15: 00007ffe55ae8278 [ 658.814534][T15985] 00:27:08 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x600) 00:27:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x5865, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x7ffffff8}, 0x0) 00:27:08 executing program 0: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='io.stat\x00', 0x0, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r0}, 0x90) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) pipe(&(0x7f0000002000)) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_ro(r2, &(0x7f00000001c0)='memory.numa_stat\x00', 0x275a, 0x0) (async) openat$cgroup_ro(r2, &(0x7f00000001c0)='memory.numa_stat\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r4, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r5, &(0x7f0000000440)=[{&(0x7f0000000080)=""/124, 0x7c}, {&(0x7f00000002c0)=""/149, 0x95}, {&(0x7f0000000380)=""/190, 0xbe}], 0x3, 0x0, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r9, r8, 0x0, 0x10000a006) (async) sendfile(r9, r8, 0x0, 0x10000a006) 00:27:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x6000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x7ffffff9}, 0x0) [ 658.938640][ T28] audit: type=1804 audit(1704328028.583:2245): pid=15999 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/921/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:27:08 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x700) 00:27:08 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:08 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x7ffffffe}, 0x0) [ 659.052497][ T28] audit: type=1804 audit(1704328028.703:2246): pid=15993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/455/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 00:27:08 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x6558, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:08 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 659.143732][ T28] audit: type=1804 audit(1704328028.703:2247): pid=15993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/455/cgroup.controllers" dev="sda1" ino=1962 res=1 errno=0 [ 659.234442][ T28] audit: type=1804 audit(1704328028.833:2248): pid=16009 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/922/cgroup.controllers" dev="sda1" ino=1957 res=1 errno=0 [ 659.268796][T16019] validate_nla: 7 callbacks suppressed [ 659.268813][T16019] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0xffffff1f}, 0x0) 00:27:09 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xa00) 00:27:09 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x2, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:09 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01fdff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x6903, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:09 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_type(r1, &(0x7f0000000000), 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r4, 0x408, 0x0, 0x0, {0x1c}}, 0x14}, 0x1, 0xf000000}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'rose0\x00'}) (async) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)={0x8e, r4, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x583}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'cgroup.type\x00'}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x400}, @ETHTOOL_A_BITSET_BIT_INDEX={0xff43}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00R\x11\xab\x83\x03'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x28}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x8001}]}, {}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '(%.\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\xfb'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE]}]}, @ETHTOOL_A_BITSET_NOMASK, @ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "1c0fd1897a6f57e23a7fcf09eaa8ad8418d907758616"}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x4000881) (async) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x40, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010101}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x40}}, 0x20004000) (async) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={0xffffffffffffffff}, 0x1, 0x0, 0x0, 0x24000000}, 0x4840) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r9, r8, 0x0, 0x10000a006) [ 659.790182][T16022] netlink: 'syz-executor.3': attribute type 10 has an invalid length. [ 659.806888][ T28] audit: type=1804 audit(1704328029.453:2249): pid=16029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/923/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:27:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x8100, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:09 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x4, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x2}, 0x0) 00:27:09 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xc00) [ 659.966332][ T28] audit: type=1804 audit(1704328029.613:2250): pid=16027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/274/cgroup.controllers" dev="sda1" ino=1963 res=1 errno=0 00:27:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 660.013036][T16043] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:09 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x3}, 0x0) 00:27:09 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x5, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 660.060158][ T28] audit: type=1804 audit(1704328029.613:2251): pid=16027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.0" name="/root/syzkaller-testdir1946341006/syzkaller.Jv1weg/274/cgroup.controllers" dev="sda1" ino=1963 res=1 errno=0 [ 660.129234][ T2791] [ 660.133057][ T2791] ============================= [ 660.137925][ T2791] WARNING: suspicious RCU usage [ 660.142844][ T2791] 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 Not tainted [ 660.149937][ T2791] ----------------------------- [ 660.154819][ T2791] net/wireless/scan.c:1867 suspicious rcu_dereference_check() usage! [ 660.161784][ T28] audit: type=1804 audit(1704328029.703:2252): pid=16042 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/924/cgroup.controllers" dev="sda1" ino=1950 res=1 errno=0 [ 660.163027][ T2791] [ 660.163027][ T2791] other info that might help us debug this: [ 660.163027][ T2791] [ 660.199877][ T2791] [ 660.199877][ T2791] rcu_scheduler_active = 2, debug_locks = 1 [ 660.207973][ T2791] 4 locks held by kworker/u4:9/2791: [ 660.213348][ T2791] #0: ffff888013071938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x789/0x15d0 [ 660.224694][ T2791] #1: ffffc9000b6dfd80 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7eb/0x15d0 [ 660.236528][ T2791] #2: ffff88807b318768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x2b/0x330 [ 660.246779][ T2791] #3: ffff88807b318168 (&rdev->bss_lock){+...}-{2:2}, at: cfg80211_inform_single_bss_frame_data+0x8e4/0x12c0 [ 660.258613][ T2791] [ 660.258613][ T2791] stack backtrace: [ 660.264528][ T2791] CPU: 0 PID: 2791 Comm: kworker/u4:9 Not tainted 6.7.0-rc6-syzkaller-01873-g2ab1efad60ad #0 [ 660.274802][ T2791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 660.284895][ T2791] Workqueue: events_unbound cfg80211_wiphy_work [ 660.291196][ T2791] Call Trace: [ 660.294516][ T2791] [ 660.297477][ T2791] dump_stack_lvl+0x125/0x1b0 [ 660.302219][ T2791] lockdep_rcu_suspicious+0x20c/0x3b0 [ 660.307656][ T2791] __cfg80211_bss_update+0x17fb/0x25f0 [ 660.313185][ T2791] ? spin_bug+0x1d0/0x1d0 [ 660.317567][ T2791] cfg80211_inform_single_bss_frame_data+0x91e/0x12c0 [ 660.324395][ T2791] ? __cfg80211_bss_update+0x25f0/0x25f0 00:27:09 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async, rerun: 64) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (rerun: 64) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) openat$cgroup_type(r1, &(0x7f0000000000), 0x2, 0x0) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={0x14, r4, 0x408, 0x0, 0x0, {0x1c}}, 0x14}, 0x1, 0xf000000}, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'rose0\x00'}) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r3, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000440)={0x8e, r4, 0x8, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_PRIVFLAGS_FLAGS={0x0, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x0, 0x3, 0x0, 0x1, [{0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'batadv_slave_0\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x583}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'cgroup.type\x00'}]}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x400}, @ETHTOOL_A_BITSET_BIT_INDEX={0xff43}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00R\x11\xab\x83\x03'}, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x28}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, 'pimreg1\x00'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_INDEX={0x0, 0x1, 0x8001}]}, {}, {0x0, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '(%.\x00'}, @ETHTOOL_A_BITSET_BIT_NAME={0x0, 0x2, '\xfb'}, @ETHTOOL_A_BITSET_BIT_VALUE, @ETHTOOL_A_BITSET_BIT_VALUE]}]}, @ETHTOOL_A_BITSET_NOMASK, @ETHTOOL_A_BITSET_VALUE={0x0, 0x4, "1c0fd1897a6f57e23a7fcf09eaa8ad8418d907758616"}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x80}, 0x4000881) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x40, 0x0, 0x10, 0x70bd27, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@rand_addr=0x64010101}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DAEMON={0x4}]}, 0x40}}, 0x20004000) sendmsg$NL80211_CMD_PROBE_CLIENT(r0, &(0x7f00000005c0)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000580)={0xffffffffffffffff}, 0x1, 0x0, 0x0, 0x24000000}, 0x4840) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r7, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r6, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r9, r8, 0x0, 0x10000a006) 00:27:09 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x34000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 660.330088][ T2791] ? lockdep_hardirqs_on_prepare+0x420/0x420 [ 660.336123][ T2791] ? dbExtendFS+0x52a/0x2030 [ 660.340796][ T2791] cfg80211_inform_bss_frame_data+0x14c/0x340 [ 660.346910][ T2791] ? cfg80211_parse_mbssid_data+0x12a0/0x12a0 [ 660.353039][ T2791] ? lock_sync+0x190/0x190 [ 660.357520][ T2791] ieee80211_bss_info_update+0x311/0xab0 [ 660.363250][ T2791] ? ieee80211_inform_bss+0x1150/0x1150 [ 660.368859][ T2791] ? ieee80211_ibss_rx_queued_mgmt+0x193e/0x30e0 [ 660.375295][ T2791] ? rcu_is_watching+0x12/0xb0 [ 660.380106][ T2791] ? trace_drv_return_void+0x174/0x1d0 [ 660.385677][ T2791] ? drv_sta_rc_update+0x394/0x5d0 [ 660.390838][ T2791] ieee80211_ibss_rx_queued_mgmt+0x1973/0x30e0 [ 660.397049][ T2791] ? hlock_class+0x4e/0x130 [ 660.401621][ T2791] ? ieee80211_ibss_rx_no_sta+0x890/0x890 [ 660.407391][ T2791] ? lock_acquire+0x1ae/0x520 [ 660.412308][ T2791] ? find_held_lock+0x2d/0x110 [ 660.417128][ T2791] ? find_held_lock+0x2d/0x110 [ 660.421957][ T2791] ? kcov_remote_start+0x371/0x6e0 [ 660.427129][ T2791] ? mark_held_locks+0x9f/0xe0 [ 660.431947][ T2791] ? kcov_remote_start+0x3d0/0x6e0 [ 660.437122][ T2791] ieee80211_iface_work+0xa67/0xda0 [ 660.442379][ T2791] ? _raw_spin_unlock_irq+0x23/0x50 [ 660.447640][ T2791] cfg80211_wiphy_work+0x24e/0x330 [ 660.452817][ T2791] process_one_work+0x886/0x15d0 [ 660.457825][ T2791] ? lock_sync+0x190/0x190 [ 660.462310][ T2791] ? workqueue_congested+0x300/0x300 [ 660.467661][ T2791] ? assign_work+0x1a0/0x250 [ 660.472582][ T2791] worker_thread+0x8b9/0x1290 [ 660.477334][ T2791] ? process_one_work+0x15d0/0x15d0 [ 660.482586][ T2791] kthread+0x2c6/0x3a0 [ 660.486700][ T2791] ? _raw_spin_unlock_irq+0x23/0x50 [ 660.491948][ T2791] ? kthread_complete_and_exit+0x40/0x40 [ 660.497629][ T2791] ret_from_fork+0x45/0x80 [ 660.502118][ T2791] ? kthread_complete_and_exit+0x40/0x40 [ 660.507893][ T2791] ret_from_fork_asm+0x11/0x20 [ 660.512756][ T2791] [ 660.568037][T16052] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:10 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x6, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x4}, 0x0) 00:27:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x400300, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:10 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xe00) 00:27:10 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01fdff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01fdff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x5}, 0x0) 00:27:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf00) [ 660.757182][T16064] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:10 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x7, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf0ffff, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x6}, 0x0) [ 660.937296][T16073] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:10 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x1000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:10 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x2603) 00:27:10 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x9, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:10 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x7}, 0x0) [ 661.144038][T16089] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x8}, 0x0) 00:27:11 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x2000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:11 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:11 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x5865) 00:27:11 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x9}, 0x0) 00:27:11 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x3000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:11 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async, rerun: 64) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (rerun: 64) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01fdff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) [ 661.902930][T16100] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:11 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x6000) 00:27:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xa}, 0x0) 00:27:11 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:11 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x4000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:11 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xc}, 0x0) 00:27:11 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x2f, 0x90, 0x7f, 0x9, 0x38, @local, @local, 0x80, 0x8, 0x6, 0xc59}}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r6}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r9}) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@bridge_setlink={0x50, 0x13, 0xa29, 0xfffffffd, 0x0, {0x7, 0x0, 0x0, r8, 0x0, 0x1040}, [@IFLA_MTU={0x8, 0x4, 0x3}, @IFLA_AF_SPEC={0x28, 0x1a, 0x0, 0x1, [@AF_MPLS={0x4}, @AF_BRIDGE={0x4}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0x18, 0x0, 0x0, 0x1f}, {0x8, 0x9, 0x0, 0x0, 0x1ac0c225}]}}, @AF_MPLS={0x4}]}]}, 0x50}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x82000010}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, 0x0, 0x20, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040000}, 0x8800) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r10, 0x0) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r13, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r12, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r16, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r15, r14, 0x0, 0x10000a006) [ 662.106866][T16119] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:11 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x6558) 00:27:11 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x500, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:11 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x5000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:11 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xe}, 0x0) 00:27:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x8100) 00:27:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xf}, 0x0) [ 662.329051][T16133] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:12 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x600, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x6000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x10}, 0x0) 00:27:12 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9f404957eee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x54, r5, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x54}}, 0x40000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) write$binfmt_misc(r0, &(0x7f0000000000)={'syz0', "fd180170d0645b0a43269d6dde92f63a999e980b78ef7dc36d1e78cd659a1184b2d0886232363b6e857ce0ef900f2a6f48302d1be155e59dd0"}, 0x3d) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x7000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:12 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x700, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x48}, 0x0) 00:27:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x8000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf000) 00:27:12 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x2f, 0x90, 0x7f, 0x9, 0x38, @local, @local, 0x80, 0x8, 0x6, 0xc59}}) (async) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) (async) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r6}) (async) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) (async) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r9}) (async) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@bridge_setlink={0x50, 0x13, 0xa29, 0xfffffffd, 0x0, {0x7, 0x0, 0x0, r8, 0x0, 0x1040}, [@IFLA_MTU={0x8, 0x4, 0x3}, @IFLA_AF_SPEC={0x28, 0x1a, 0x0, 0x1, [@AF_MPLS={0x4}, @AF_BRIDGE={0x4}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0x18, 0x0, 0x0, 0x1f}, {0x8, 0x9, 0x0, 0x0, 0x1ac0c225}]}}, @AF_MPLS={0x4}]}]}, 0x50}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x82000010}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, 0x0, 0x20, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040000}, 0x8800) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r10, 0x0) (async) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r13, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r12, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) r16 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r16, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r15, r14, 0x0, 0x10000a006) 00:27:12 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x34000) 00:27:12 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x9000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 663.160099][ T28] kauditd_printk_skb: 18 callbacks suppressed [ 663.160115][ T28] audit: type=1804 audit(1704328032.813:2271): pid=16157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/932/cgroup.controllers" dev="sda1" ino=1970 res=1 errno=0 00:27:12 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x78d, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:12 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x4c}, 0x0) [ 663.262610][ T28] audit: type=1804 audit(1704328032.903:2272): pid=16153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/461/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 00:27:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xa000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 663.379718][ T28] audit: type=1804 audit(1704328032.903:2273): pid=16153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/461/cgroup.controllers" dev="sda1" ino=1952 res=1 errno=0 [ 663.473111][ T28] audit: type=1804 audit(1704328032.993:2274): pid=16168 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/933/cgroup.controllers" dev="sda1" ino=1972 res=1 errno=0 00:27:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x60}, 0x0) 00:27:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x400300) 00:27:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9f404957eee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x54, r5, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x54}}, 0x40000) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async, rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_misc(r0, &(0x7f0000000000)={'syz0', "fd180170d0645b0a43269d6dde92f63a999e980b78ef7dc36d1e78cd659a1184b2d0886232363b6e857ce0ef900f2a6f48302d1be155e59dd0"}, 0x3d) (async, rerun: 64) sendfile(r7, r6, 0x0, 0x10000a006) (rerun: 64) 00:27:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xc000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:13 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) pipe(&(0x7f0000002000)) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x2f, 0x90, 0x7f, 0x9, 0x38, @local, @local, 0x80, 0x8, 0x6, 0xc59}}) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000340)={'syztnl1\x00', &(0x7f00000002c0)={'ip6gre0\x00', 0x0, 0x2f, 0x90, 0x7f, 0x9, 0x38, @local, @local, 0x80, 0x8, 0x6, 0xc59}}) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r6}) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) (async) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r5}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) (async) r7 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r9 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r9}) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=@bridge_setlink={0x50, 0x13, 0xa29, 0xfffffffd, 0x0, {0x7, 0x0, 0x0, r8, 0x0, 0x1040}, [@IFLA_MTU={0x8, 0x4, 0x3}, @IFLA_AF_SPEC={0x28, 0x1a, 0x0, 0x1, [@AF_MPLS={0x4}, @AF_BRIDGE={0x4}, @AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0x18, 0x0, 0x0, 0x1f}, {0x8, 0x9, 0x0, 0x0, 0x1ac0c225}]}}, @AF_MPLS={0x4}]}]}, 0x50}}, 0x0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x82000010}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, 0x0, 0x20, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040000}, 0x8800) (async) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x82000010}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0x88, 0x0, 0x20, 0x70bd26, 0x25dfdbff, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'sit0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pimreg\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040000}, 0x8800) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r10, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r10, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) r11 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r13, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r12, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r10, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r15 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r16 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r16, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r16, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r15, r14, 0x0, 0x10000a006) (async) sendfile(r15, r14, 0x0, 0x10000a006) 00:27:13 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x900, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:13 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf00, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xe000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf0ffff) 00:27:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x68}, 0x0) [ 663.838128][ T28] audit: type=1804 audit(1704328033.483:2275): pid=16182 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/934/cgroup.controllers" dev="sda1" ino=1960 res=1 errno=0 [ 663.919637][ T28] audit: type=1804 audit(1704328033.543:2276): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/462/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:13 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x8d07, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 664.000506][ T28] audit: type=1804 audit(1704328033.543:2277): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/462/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x6c}, 0x0) 00:27:13 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 664.094949][ T28] audit: type=1804 audit(1704328033.543:2278): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/462/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:13 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9f404957eee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), r0) sendmsg$DEVLINK_CMD_RATE_DEL(r0, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x54, r5, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0x54}}, 0x40000) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_misc(r0, &(0x7f0000000000)={'syz0', "fd180170d0645b0a43269d6dde92f63a999e980b78ef7dc36d1e78cd659a1184b2d0886232363b6e857ce0ef900f2a6f48302d1be155e59dd0"}, 0x3d) (async) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:13 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x541b, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) sendfile(r8, r9, &(0x7f00000002c0)=0x101, 0x1bd) sendfile(r6, r5, 0x0, 0x10000a006) 00:27:13 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x10000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x1000000) 00:27:13 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x34000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 664.182167][ T28] audit: type=1804 audit(1704328033.543:2279): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/462/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:13 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x74}, 0x0) 00:27:13 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x2000000) [ 664.267802][ T28] audit: type=1804 audit(1704328033.543:2280): pid=16188 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.1" name="/root/syzkaller-testdir2482002300/syzkaller.IiuR6R/462/cgroup.controllers" dev="sda1" ino=1956 res=1 errno=0 00:27:14 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x60000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 664.368016][T16217] validate_nla: 7 callbacks suppressed [ 664.368035][T16217] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:14 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x400300, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x7a}, 0x0) 00:27:14 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x65580000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x3000000) 00:27:14 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) write$binfmt_script(r2, &(0x7f0000000500)={'#! ', './file0', [{0x20, ')\xea),[!'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '):[(\xb0'}, {0x20, '&'}, {0x20, '\xe3&-'}, {0x20, '[#.'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '-'}], 0xa, "fac8d5b9c0edda2214373a66ada3c369fa88ec9da606119a909b07c9112dbaaa09be8f8ef20102016367cacb0af1632cef2f559b3e45c609c99ba53421d04db47e59d6c8222f02e001fccf899ffea59185b7d04806cccb0174a0"}, 0xa2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={r1}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) write$binfmt_script(r0, &(0x7f00000003c0)={'#! ', './file0', [{0x20, ',)\'.$,'}, {0x20, 'cgroup.controllers\x00'}, {0x20, 'wlan1\x00'}, {0x20, ')\xea),[!'}, {0x20, '&'}], 0xa, "79366fe2ca1873963336a8b468edb799dd050a979b7e4ec6f588e626896aaf15c79179c4b40cbc9e90e0a808c2e6bd5de6636dcab843788a3bd5248eef68f51fc8cd74553910f384c128e9cf7152fd23f187cb23345f2b004bd98890f45e56b7a52ff36028a20dd649d03b172347410e8aaa338261c4bf65c6ecd467aab5559c4c637d1d7ffef927bf94d227adc1ea849fd7631584a3da5b3b7934df6d8969ff77c0b717ba1dfd57a1d1a09e85bf32ae3c21d891675552a5b8a85eb787ab8080b47581b1b0bf09ea8441d9c7d2af44ac245155ddfbb99f02"}, 0x10e) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r9, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xd11b, 0x38}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x20000000) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r6, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r5, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r13, r12, 0x0, 0x10000a006) [ 664.559937][T16230] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:14 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async, rerun: 32) socket$inet6_udplite(0xa, 0x2, 0x88) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) (async) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x541b, 0x0) (async, rerun: 64) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) (rerun: 64) sendfile(r8, r9, &(0x7f00000002c0)=0x101, 0x1bd) sendfile(r6, r5, 0x0, 0x10000a006) 00:27:14 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf0ffff, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xf0}, 0x0) 00:27:14 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x69030000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x4000000) 00:27:14 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x6000000) 00:27:14 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x121}, 0x0) [ 665.267323][T16246] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x81000000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:15 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x1000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x300}, 0x0) [ 665.464538][T16258] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:15 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) pipe(&(0x7f0000002000)) (async) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) write$binfmt_script(r2, &(0x7f0000000500)={'#! ', './file0', [{0x20, ')\xea),[!'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '):[(\xb0'}, {0x20, '&'}, {0x20, '\xe3&-'}, {0x20, '[#.'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '-'}], 0xa, "fac8d5b9c0edda2214373a66ada3c369fa88ec9da606119a909b07c9112dbaaa09be8f8ef20102016367cacb0af1632cef2f559b3e45c609c99ba53421d04db47e59d6c8222f02e001fccf899ffea59185b7d04806cccb0174a0"}, 0xa2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={r1}) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={r1}) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) write$binfmt_script(r0, &(0x7f00000003c0)={'#! ', './file0', [{0x20, ',)\'.$,'}, {0x20, 'cgroup.controllers\x00'}, {0x20, 'wlan1\x00'}, {0x20, ')\xea),[!'}, {0x20, '&'}], 0xa, "79366fe2ca1873963336a8b468edb799dd050a979b7e4ec6f588e626896aaf15c79179c4b40cbc9e90e0a808c2e6bd5de6636dcab843788a3bd5248eef68f51fc8cd74553910f384c128e9cf7152fd23f187cb23345f2b004bd98890f45e56b7a52ff36028a20dd649d03b172347410e8aaa338261c4bf65c6ecd467aab5559c4c637d1d7ffef927bf94d227adc1ea849fd7631584a3da5b3b7934df6d8969ff77c0b717ba1dfd57a1d1a09e85bf32ae3c21d891675552a5b8a85eb787ab8080b47581b1b0bf09ea8441d9c7d2af44ac245155ddfbb99f02"}, 0x10e) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r9, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xd11b, 0x38}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x20000000) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r6, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r5, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r13, r12, 0x0, 0x10000a006) 00:27:15 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) (async) socket$inet6_udplite(0xa, 0x2, 0x88) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r1}, 0x90) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000240)=ANY=[], 0x3af4701e) socket$igmp(0x2, 0x3, 0x2) (async) r8 = socket$igmp(0x2, 0x3, 0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x541b, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x541b, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) sendfile(r8, r9, &(0x7f00000002c0)=0x101, 0x1bd) sendfile(r6, r5, 0x0, 0x10000a006) 00:27:15 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x2000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:15 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x7000000) 00:27:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x88a8ffff, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x500}, 0x0) [ 665.637153][T16269] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:15 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x4000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x9effffff, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:15 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x8000000) 00:27:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x600}, 0x0) 00:27:15 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xf0ffffff, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:15 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x700}, 0x0) [ 665.853381][T16283] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:15 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xa000000) 00:27:16 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:16 executing program 1: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r2}, 0x90) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) (async) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r3, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) write$binfmt_script(r2, &(0x7f0000000500)={'#! ', './file0', [{0x20, ')\xea),[!'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '):[(\xb0'}, {0x20, '&'}, {0x20, '\xe3&-'}, {0x20, '[#.'}, {0x20, 'net_prio.prioidx\x00'}, {0x20, '-'}], 0xa, "fac8d5b9c0edda2214373a66ada3c369fa88ec9da606119a909b07c9112dbaaa09be8f8ef20102016367cacb0af1632cef2f559b3e45c609c99ba53421d04db47e59d6c8222f02e001fccf899ffea59185b7d04806cccb0174a0"}, 0xa2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={r1}) (async) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000000)={r1}) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) write$binfmt_script(r0, &(0x7f00000003c0)={'#! ', './file0', [{0x20, ',)\'.$,'}, {0x20, 'cgroup.controllers\x00'}, {0x20, 'wlan1\x00'}, {0x20, ')\xea),[!'}, {0x20, '&'}], 0xa, "79366fe2ca1873963336a8b468edb799dd050a979b7e4ec6f588e626896aaf15c79179c4b40cbc9e90e0a808c2e6bd5de6636dcab843788a3bd5248eef68f51fc8cd74553910f384c128e9cf7152fd23f187cb23345f2b004bd98890f45e56b7a52ff36028a20dd649d03b172347410e8aaa338261c4bf65c6ecd467aab5559c4c637d1d7ffef927bf94d227adc1ea849fd7631584a3da5b3b7934df6d8969ff77c0b717ba1dfd57a1d1a09e85bf32ae3c21d891675552a5b8a85eb787ab8080b47581b1b0bf09ea8441d9c7d2af44ac245155ddfbb99f02"}, 0x10e) socket$nl_generic(0x10, 0x3, 0x10) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r10, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}}, 0x0) (async) sendmsg$NL80211_CMD_SET_MCAST_RATE(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r9, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r7, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r9, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xd11b, 0x38}}}}, [@NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}, @NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x90}, 0x20000000) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r6, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r5, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r14 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r14, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r13, r12, 0x0, 0x10000a006) 00:27:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xffffa888, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:16 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x5000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x900}, 0x0) 00:27:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xc000000) 00:27:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xa00}, 0x0) 00:27:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xe000000) [ 666.536951][T16304] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xfffff000, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:16 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x6000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:16 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xb9e}, 0x0) 00:27:16 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xffffff7f, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 666.747000][T16316] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:16 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0xf000000) 00:27:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xffffff9e, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:17 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) (async) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) socket$inet6_udplite(0xa, 0x2, 0x88) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0xb00000000065808, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) (async) sendfile(r5, r4, 0x0, 0x10000a006) (async) 00:27:17 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x7000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x10000000) 00:27:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xb9f}, 0x0) 00:27:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r5 = openat$cgroup_ro(r1, &(0x7f0000000800)='freezer.self_freezing\x00', 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f0000000840)='pids.current\x00', 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01cdff02000000000000000005006a090000", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f00000002c0)={"388b7f08784702f1f8938b6ee09d207f", 0x0, 0x0, {0xd4, 0x9}, {0x9, 0x3}, 0x7ddba41d, [0xffffffffffffffff, 0xf98, 0x5, 0x49, 0x8, 0x2, 0x8, 0xffff, 0x3, 0xf38000, 0xffffffff80000000, 0x101ae08b, 0x12, 0x5, 0x7fffffff]}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000880)={0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f00000003c0)={"74a5611060e9376954aa256ba73d65e4", r9, 0x0, {0x4, 0x290f}, {0x20, 0x1}, 0x3, [0x6, 0x9, 0x5, 0x5, 0x8000000000000000, 0x8001, 0xfffffffffffffffa, 0x4, 0xffffffff, 0x86f, 0xbbb, 0x6, 0x6f1, 0x5, 0x7fffffff, 0x3ff]}) r10 = socket$netlink(0x10, 0x3, 0x4) preadv(r0, &(0x7f00000007c0)=[{&(0x7f0000000600)=""/42, 0x2a}, {&(0x7f0000000640)=""/66, 0x42}, {&(0x7f00000006c0)=""/31, 0x1f}, {&(0x7f0000000700)=""/172, 0xac}], 0x4, 0x9, 0x8) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r10, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000201}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x88, 0x1403, 0x0, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'pim6reg0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ip6erspan0\x00'}}]}, 0x88}, 0x1, 0x0, 0x0, 0x24000844}, 0x4001) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xfffffff0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xba0}, 0x0) [ 667.446276][T16332] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:17 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x9000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x26030000) 00:27:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xba1}, 0x0) [ 667.620574][T16342] netlink: 'syz-executor.3': attribute type 10 has an invalid length. 00:27:17 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf000000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x60000000) 00:27:17 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r4 = openat$cgroup_ro(r0, &(0x7f0000000000)='cgroup.controllers\x00', 0xb00000000065808, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r5, r4, 0x0, 0x10000a006) 00:27:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0xffffffff, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x20, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xc00}, 0x0) 00:27:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x65580000) 00:27:17 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0xb, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:17 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x8d070000, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:17 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xe00}, 0x0) 00:27:17 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x81000000) 00:27:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="c9e818e1ffee24"], 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) (async) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) openat$cgroup_ro(r1, &(0x7f0000000800)='freezer.self_freezing\x00', 0x0, 0x0) (async) r5 = openat$cgroup_ro(r1, &(0x7f0000000800)='freezer.self_freezing\x00', 0x0, 0x0) openat$cgroup_ro(r5, &(0x7f0000000840)='pids.current\x00', 0x0, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01cdff02000000000000000005006a090000", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) (async) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r4, @ANYBLOB="01cdff02000000000000000005006a090000", @ANYRES32=r3, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) (async) preadv(r1, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r6, 0xc0c89425, &(0x7f00000002c0)={"388b7f08784702f1f8938b6ee09d207f", 0x0, 0x0, {0xd4, 0x9}, {0x9, 0x3}, 0x7ddba41d, [0xffffffffffffffff, 0xf98, 0x5, 0x49, 0x8, 0x2, 0x8, 0xffff, 0x3, 0xf38000, 0xffffffff80000000, 0x101ae08b, 0x12, 0x5, 0x7fffffff]}) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f0000000880)={0x0, 0x0, 0x0, 0xffffffffffffffff}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r7, 0xc0c89425, &(0x7f00000003c0)={"74a5611060e9376954aa256ba73d65e4", r9, 0x0, {0x4, 0x290f}, {0x20, 0x1}, 0x3, [0x6, 0x9, 0x5, 0x5, 0x8000000000000000, 0x8001, 0xfffffffffffffffa, 0x4, 0xffffffff, 0x86f, 0xbbb, 0x6, 0x6f1, 0x5, 0x7fffffff, 0x3ff]}) r10 = socket$netlink(0x10, 0x3, 0x4) preadv(r0, &(0x7f00000007c0)=[{&(0x7f0000000600)=""/42, 0x2a}, {&(0x7f0000000640)=""/66, 0x42}, {&(0x7f00000006c0)=""/31, 0x1f}, {&(0x7f0000000700)=""/172, 0xac}], 0x4, 0x9, 0x8) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r10, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000201}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0x88, 0x1403, 0x0, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'veth1_to_bridge\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'pim6reg0\x00'}}, {{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'ip6erspan0\x00'}}]}, 0x88}, 0x1, 0x0, 0x0, 0x24000844}, 0x4001) write$binfmt_script(r8, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r7, r6, 0x0, 0x10000a006) (async) sendfile(r7, r6, 0x0, 0x10000a006) 00:27:17 executing program 0: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='net_prio.prioidx\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="c9e8e851efacfcead568dcee24000000000000"], 0x208e24b) openat$cgroup_ro(r0, &(0x7f0000000400)='cpuset.memory_pressure\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="48040000", @ANYRES16=r3, @ANYBLOB="01e5ff000004000004003b1c210008000300", @ANYRES32=r2, @ANYBLOB="2c0433005000de295b3acba52ee4080211000001505050505050"], 0x448}}, 0x0) pipe(&(0x7f0000002000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000002800)={0x0, 0xf, &(0x7f0000002380)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, r4}, 0x90) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r4, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r5, 0x200, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x30, r6, 0x100, 0x70bd29, 0x25dfdbfd, {{}, {@void, @void}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac05}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffffff000}], 0x5, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.freeze\x00', 0xb00000000065808, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r9, &(0x7f0000000240)=ANY=[], 0x3af4701e) sendfile(r8, r7, 0x0, 0x10000a006) 00:27:18 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x88a8ffff) 00:27:18 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x9effffff, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0xf00}, 0x0) [ 668.373832][ T28] kauditd_printk_skb: 36 callbacks suppressed [ 668.373849][ T28] audit: type=1804 audit(1704328038.023:2317): pid=16372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz-executor.4" name="/root/syzkaller-testdir3025654639/syzkaller.zbUzPd/951/cgroup.controllers" dev="sda1" ino=1974 res=1 errno=0 00:27:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0xf, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) 00:27:18 executing program 3: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0xf0ffffff, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43d000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1}, 0x0) 00:27:18 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef43c000000e3bd6efb440009000e000a000f000000ba8000001201", 0x2e}], 0x1, 0x0, 0x1f00}, 0x0) 00:27:18 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r2}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x52, &(0x7f00000000c0)={&(0x7f0000000000)=@bridge_setlink={0x94, 0x13, 0xa29, 0x0, 0x0, {0x7, 0x0, 0x0, r1}, [@IFLA_AF_SPEC={0x8, 0x18, 0x0, 0x0, [@AF_BRIDGE={0x4e00}]}, @IFLA_AF_SPEC={0x6c, 0x1a, 0x0, 0x1, [@AF_INET6={0x54, 0x3, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @mcast1}, @IFLA_INET6_TOKEN={0xffffffffffffff92, 0x7, @private1}, @IFLA_INET6_TOKEN={0x14, 0x7, @dev}, @IFLA_INET6_ADDR_GEN_MODE]}, @AF_BRIDGE={0x2}, @AF_INET6={0xc}, @AF_MPLS={0x4}]}]}, 0x94}}, 0x9effffff) 00:27:18 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)=@ipv6_getnexthop={0x10, 0x6a, 0x1, 0x0, 0x0, {}, [@NHA_ID={0x8, 0x1, 0x2}]}, 0x20}}, 0x0) [ 668.546528][ T28] audit: type=1804 audit(1704328038.193:2318): pid=16386 uid=0 auid=4294967295 ses=4