3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, 0x0) 03:28:53 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000600000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:53 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4ed", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:28:53 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(0xffffffffffffffff, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:28:53 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000700000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 928.894777][T14237] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:53 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000800000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:53 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000900000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000a00000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 929.530332][T14263] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:54 executing program 1: openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, 0x0) 03:28:54 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000c00000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:54 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x0, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:28:54 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4ed", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:28:54 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000e00000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 930.449031][T14281] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000f00000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:55 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100001000000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 930.969069][T14299] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 931.062848][T14308] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 931.472657][ T1215] ieee802154 phy0 wpan0: encryption failed: -22 [ 931.478989][ T1215] ieee802154 phy1 wpan1: encryption failed: -22 03:28:56 executing program 1: openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, &(0x7f0000000340)) 03:28:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100006000000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:56 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4ed", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:28:56 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x0, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:28:56 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000f000000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 932.444575][T14322] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000003000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000a603000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:57 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 932.960400][T14338] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 933.050293][T14343] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:58 executing program 1: openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, &(0x7f0000000340)) 03:28:58 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb7", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:28:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000005000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:58 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:58 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:58 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x0, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:28:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000006000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:28:58 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000007000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 934.063808][T14356] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:28:59 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:28:59 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:28:59 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000009000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 934.488026][T14376] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 934.609141][T14380] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:00 executing program 1: openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, &(0x7f0000000340)) 03:29:00 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000a000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:00 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, 0xffffffffffffffff) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:00 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4ed", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000c000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:00 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000e000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 936.168840][T14400] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 936.278455][T14415] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:00 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000f000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 936.478037][T14419] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:02 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100006558000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:02 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:02 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, 0xffffffffffffffff) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:02 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000060000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 937.797219][T14439] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100005865000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:02 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 938.168223][T14454] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 938.197373][T14451] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 938.251771][T14451] batman_adv: batadv0: Adding interface: team0 [ 938.258195][T14451] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 938.306576][T14451] batman_adv: batadv0: Interface activated: team0 [ 938.338947][T14451] batman_adv: batadv0: Interface deactivated: team0 03:29:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000081000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 938.397680][T14457] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:02 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:03 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:03 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000003a6000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:03 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:03 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, 0xffffffffffffffff) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000f0000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000040030000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 938.663359][T14467] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:03 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) [ 938.752451][T14463] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000003400000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:03 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:03 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:03 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000fffff00000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 939.352855][T14496] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:03 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:04 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:04 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000100000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:04 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(0x0, 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:04 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:04 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000200000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:04 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(0x0, 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:04 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:04 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000300000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:04 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:04 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(0x0, 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:04 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000400000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:04 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:04 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000500000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:04 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(0x0, 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:05 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(0x0, 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:05 executing program 4: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:05 executing program 1: openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) prlimit64(0x0, 0x0, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r3, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) sched_setscheduler(r0, 0x1, 0x0) 03:29:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000600000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:05 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000700000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:05 executing program 4: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:05 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000800000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000900000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:05 executing program 4: ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:05 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:06 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(0x0, 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:06 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 941.696741][T14585] validate_nla: 6 callbacks suppressed [ 941.696759][T14585] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:06 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7f06) unlinkat(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:06 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000a00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:06 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:06 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, 0x0, &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:06 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:06 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000c00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 942.484101][T14597] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:07 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, 0x0, &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:07 executing program 1: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000e00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 942.650151][T14602] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:07 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000f00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:07 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, 0x0, &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 943.129894][T14613] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000001000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:07 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d97", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:07 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000006000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 943.312654][T14633] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:08 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:08 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000586500000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:08 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:08 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000008100000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:08 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 943.620040][T14655] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000ffffa88800000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000ffffff9e00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:08 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:08 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:08 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000003a600000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:09 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:09 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d97", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000fffffff000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:09 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 944.413172][T14678] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:09 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000088a8ffff00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:09 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 944.662675][T14687] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000f0ffff00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:09 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 945.047734][T14698] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 945.062591][T14700] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 945.072479][T14700] batman_adv: batadv0: Removing interface: team0 [ 945.150377][T14700] bridge0: port 1(team0) entered blocking state [ 945.162984][T14700] bridge0: port 1(team0) entered disabled state 03:29:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100007fffffff00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 945.188974][T14700] team0: entered allmulticast mode 03:29:09 executing program 1: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d9768a4edb72d4d91025d3631047d32aad146bcfb2ee6a7a0dfbf1484a5c82ecba56bb23eec81391bf49d58909e69f211feab6c2b7055311f086fa5fe99765d7c31da45050421a3865e3c175d10c302df85b66881401bfcfb39000000000000000000de0000a4af350085", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 945.246295][T14700] team0: entered promiscuous mode 03:29:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100009effffff00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 945.248796][T14700] 8021q: adding VLAN 0 to HW filter on device team0 03:29:10 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:11 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:11 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:11 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000f0ffffff00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:11 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:11 executing program 1: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:11 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:11 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000081200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:12 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d97", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:12 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000002000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 947.743787][T14728] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:12 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:12 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 947.954176][T14751] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000003000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:12 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:12 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:12 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:12 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:12 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000004000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:12 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:12 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x0, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000005000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 948.260551][T14758] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:13 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x0, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 948.721461][T14774] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:13 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000006000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:13 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:13 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000007000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:13 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x0, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 948.916282][T14787] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:13 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e89d", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) [ 949.179008][T14801] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:15 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(0x0, 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:15 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000008000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:15 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:15 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, 0x0, 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:15 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:15 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e8", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:15 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000009000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:15 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 950.884398][T14810] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 950.892840][T14816] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 950.892885][T14816] team0: left allmulticast mode [ 950.892899][T14816] team0: left promiscuous mode [ 950.893002][T14816] bridge0: port 1(team0) entered disabled state [ 951.214106][T14816] batman_adv: batadv0: Adding interface: team0 [ 951.214121][T14816] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 951.215437][T14816] batman_adv: batadv0: Interface activated: team0 [ 951.284333][T14816] batman_adv: batadv0: Interface deactivated: team0 03:29:15 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:15 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:15 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000a000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:15 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:15 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:16 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 951.407185][T14827] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:16 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, 0x0, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 951.503703][T14829] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 951.528554][T14836] batman_adv: batadv0: Removing interface: team0 [ 951.558332][T14836] bridge0: port 1(team0) entered blocking state [ 951.571218][T14836] bridge0: port 1(team0) entered disabled state [ 951.577880][T14836] team0: entered allmulticast mode [ 951.585772][T14836] team0: entered promiscuous mode [ 951.593554][T14836] 8021q: adding VLAN 0 to HW filter on device team0 03:29:16 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, 0x0, 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:16 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000c000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:18 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:18 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, 0x0, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:18 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000e000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:18 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, 0x0, 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:18 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000f000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:18 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, 0x0, 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000010000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 953.947145][T14859] validate_nla: 2 callbacks suppressed [ 953.947157][T14859] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:18 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 953.998727][T14859] team0: left allmulticast mode 03:29:18 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440), 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 953.998756][T14859] team0: left promiscuous mode [ 953.999003][T14859] bridge0: port 1(team0) entered disabled state [ 954.017446][T14859] batman_adv: batadv0: Adding interface: team0 [ 954.017459][T14859] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 954.017572][T14859] batman_adv: batadv0: Interface activated: team0 [ 954.018525][T14859] batman_adv: batadv0: Interface deactivated: team0 [ 954.024066][T14857] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 954.024246][T14868] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 954.024269][T14868] batman_adv: batadv0: Removing interface: team0 [ 954.037330][T14868] bridge0: port 1(team0) entered blocking state [ 954.127611][T14868] bridge0: port 1(team0) entered disabled state 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000060000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 954.127767][T14868] team0: entered allmulticast mode 03:29:18 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, 0xffffffffffffffff, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:18 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440), 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 954.129624][T14868] team0: entered promiscuous mode [ 954.169328][T14868] 8021q: adding VLAN 0 to HW filter on device team0 03:29:18 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8e8", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000f0000000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 954.214684][T14875] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 954.348285][T14883] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:18 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:18 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440), 0x0) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:18 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abe", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:18 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000030000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:19 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x0) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:19 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{0x0}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:19 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000a6030000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:19 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{0x0}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:19 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000050000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:19 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{0x0}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 954.725123][T14904] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:19 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abeb8", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:19 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000060000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:20 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:20 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:20 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x0) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:20 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0abe", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000070000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:20 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000090000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:20 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 955.659088][T14932] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:20 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x0) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 955.723059][T14935] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 955.723108][T14935] team0: left allmulticast mode [ 955.723122][T14935] team0: left promiscuous mode [ 955.723235][T14935] bridge0: port 1(team0) entered disabled state [ 955.734070][T14935] batman_adv: batadv0: Adding interface: team0 [ 955.734083][T14935] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 955.734178][T14935] batman_adv: batadv0: Interface activated: team0 [ 955.734737][T14935] batman_adv: batadv0: Interface deactivated: team0 [ 955.753479][T14935] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 955.753511][T14935] batman_adv: batadv0: Removing interface: team0 [ 955.775989][T14935] bridge0: port 1(team0) entered blocking state [ 955.781053][T14935] bridge0: port 1(team0) entered disabled state 03:29:20 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 955.781168][T14935] team0: entered allmulticast mode [ 955.789864][T14935] team0: entered promiscuous mode 03:29:20 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 956.264214][T14935] 8021q: adding VLAN 0 to HW filter on device team0 03:29:20 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 956.310343][T14946] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:21 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, 0x0, 0x0) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:21 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000a0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:21 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x0) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 956.726754][T14962] team0: left allmulticast mode [ 956.735219][T14962] team0: left promiscuous mode [ 956.740286][T14962] bridge0: port 1(team0) entered disabled state [ 957.039699][T14962] batman_adv: batadv0: Adding interface: team0 [ 957.046175][T14962] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 957.083047][T14962] batman_adv: batadv0: Interface activated: team0 [ 957.114287][T14962] batman_adv: batadv0: Interface deactivated: team0 03:29:22 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb0a", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:22 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:22 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000c0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:22 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:22 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:22 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:22 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000e0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 958.474754][T14971] batman_adv: batadv0: Removing interface: team0 03:29:23 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(0xffffffffffffffff, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 958.776016][T14971] bridge0: port 1(team0) entered blocking state [ 958.799789][T14971] bridge0: port 1(team0) entered disabled state 03:29:23 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000f0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 958.830402][T14971] team0: entered allmulticast mode [ 958.846961][T14971] team0: entered promiscuous mode [ 958.853126][T14971] 8021q: adding VLAN 0 to HW filter on device team0 03:29:23 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 959.192583][T14997] validate_nla: 6 callbacks suppressed [ 959.192595][T14997] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:25 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r6, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:25 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000065580000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:25 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:25 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000600000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 960.689060][T15010] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000058650000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 960.988455][T15008] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:25 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, 0x0, 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 961.034312][T15008] team0: left allmulticast mode [ 961.039408][T15008] team0: left promiscuous mode 03:29:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 961.078249][T15008] bridge0: port 1(team0) entered disabled state [ 961.094074][T15008] batman_adv: batadv0: Adding interface: team0 [ 961.101633][T15008] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:29:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d00", 0x4a}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 961.164677][T15008] batman_adv: batadv0: Interface activated: team0 [ 961.179026][T15008] batman_adv: batadv0: Interface deactivated: team0 03:29:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d00", 0x4a}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 961.230572][T15022] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 961.239827][T15022] batman_adv: batadv0: Removing interface: team0 [ 961.308198][T15022] bridge0: port 1(team0) entered blocking state [ 961.316322][T15022] bridge0: port 1(team0) entered disabled state [ 961.340392][T15022] team0: entered allmulticast mode [ 961.355279][T15022] team0: entered promiscuous mode [ 961.365569][T15022] 8021q: adding VLAN 0 to HW filter on device team0 [ 961.375427][T15025] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000810000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:26 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(0x0, 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:26 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:26 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:26 executing program 1: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000003a60000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:26 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(0x0, 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 961.559486][T15038] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000f00000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca", 0x3e}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca", 0x3e}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000400300000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000034000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 962.299499][T15067] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:26 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:26 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:26 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r6, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca", 0x3e}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:27 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(0x0, 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000fffff000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000001000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca", 0x44}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 962.873386][T15084] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 962.892831][T15093] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca", 0x44}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 962.924137][T15093] team0: left allmulticast mode 03:29:27 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca", 0x3e}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 962.975808][T15093] team0: left promiscuous mode [ 962.988319][T15093] bridge0: port 1(team0) entered disabled state [ 963.054821][T15093] batman_adv: batadv0: Adding interface: team0 [ 963.061838][T15093] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:29:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000002000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 963.104253][T15093] batman_adv: batadv0: Interface activated: team0 [ 963.109340][T15093] batman_adv: batadv0: Interface deactivated: team0 [ 963.139334][T15097] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 963.156730][T15097] batman_adv: batadv0: Removing interface: team0 [ 963.169660][T15097] bridge0: port 1(team0) entered blocking state [ 963.176877][T15097] bridge0: port 1(team0) entered disabled state [ 963.184107][T15097] team0: entered allmulticast mode [ 963.193337][T15097] team0: entered promiscuous mode [ 963.239734][T15097] 8021q: adding VLAN 0 to HW filter on device team0 03:29:27 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:29 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:29 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:29 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb", 0x38}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:29 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r6, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:29 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000004000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:29 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb", 0x38}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000005000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 965.715505][T15135] validate_nla: 1 callbacks suppressed [ 965.715526][T15135] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 965.760206][T15120] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 965.784778][T15120] team0: left allmulticast mode [ 965.784797][T15120] team0: left promiscuous mode [ 965.784914][T15120] bridge0: port 1(team0) entered disabled state 03:29:30 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 965.792208][T15120] batman_adv: batadv0: Adding interface: team0 [ 965.792221][T15120] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 965.792316][T15120] batman_adv: batadv0: Interface activated: team0 [ 965.794206][T15120] batman_adv: batadv0: Interface deactivated: team0 03:29:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000006000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 965.896474][T15138] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 965.906284][T15138] batman_adv: batadv0: Removing interface: team0 [ 965.931845][T15138] bridge0: port 1(team0) entered blocking state [ 965.945103][T15138] bridge0: port 1(team0) entered disabled state [ 965.952784][T15138] team0: entered allmulticast mode [ 966.000229][T15138] team0: entered promiscuous mode [ 966.007439][T15138] 8021q: adding VLAN 0 to HW filter on device team0 [ 966.027523][T15145] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000007000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:30 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:30 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r6, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:30 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:30 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000008000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 966.343517][T15155] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000009000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 966.375508][T15158] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 966.375554][T15158] team0: left allmulticast mode [ 966.375567][T15158] team0: left promiscuous mode 03:29:31 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:31 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 966.375677][T15158] bridge0: port 1(team0) entered disabled state 03:29:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000a000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 966.398774][T15158] batman_adv: batadv0: Adding interface: team0 [ 966.398786][T15158] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 966.398874][T15158] batman_adv: batadv0: Interface activated: team0 [ 966.399480][T15158] batman_adv: batadv0: Interface deactivated: team0 [ 966.435860][T15158] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 966.435885][T15158] batman_adv: batadv0: Removing interface: team0 [ 966.759041][T15158] bridge0: port 1(team0) entered blocking state [ 966.759089][T15158] bridge0: port 1(team0) entered disabled state [ 966.759173][T15158] team0: entered allmulticast mode [ 966.762871][T15158] team0: entered promiscuous mode [ 966.765085][T15158] 8021q: adding VLAN 0 to HW filter on device team0 [ 966.796995][T15172] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 966.940433][T15184] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 966.940527][T15184] team0: left allmulticast mode [ 966.940543][T15184] team0: left promiscuous mode [ 966.943408][T15184] bridge0: port 1(team0) entered disabled state 03:29:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f8", 0x2c}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:31 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f8", 0x2c}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 967.305795][T15184] batman_adv: batadv0: Adding interface: team0 [ 967.317602][T15184] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 967.358824][T15184] batman_adv: batadv0: Interface activated: team0 [ 967.387641][T15184] batman_adv: batadv0: Interface deactivated: team0 03:29:32 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f8", 0x2c}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 967.762872][T15185] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:33 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:33 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000c000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:33 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e", 0x2f}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:33 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, 0x0, 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:33 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000e000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:33 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:33 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e", 0x2f}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:33 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, 0x0, 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000f000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e", 0x2f}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:34 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], 0x0, 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000010000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:34 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:34 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, 0x0, 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000060000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:34 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:34 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:34 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a08", 0x31}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000005865000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:34 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], 0x0, 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:34 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:34 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) dup(r5) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000081000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) 03:29:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) 03:29:35 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) 03:29:35 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000ffffa888000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 970.672847][T15282] batman_adv: batadv0: Removing interface: team0 [ 970.686405][T15282] bridge0: port 1(team0) entered blocking state [ 970.688203][T15282] bridge0: port 1(team0) entered disabled state [ 970.688487][T15282] team0: entered allmulticast mode 03:29:35 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:35 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:35 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb", 0x38}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 970.692536][T15282] team0: entered promiscuous mode [ 970.695686][T15282] 8021q: adding VLAN 0 to HW filter on device team0 [ 970.988961][T15289] validate_nla: 9 callbacks suppressed [ 970.988979][T15289] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000ffffff9e000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:35 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:35 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca", 0x44}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:29:35 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:35 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], 0x0, 0x4, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000003a6000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:35 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 971.417593][T15304] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 971.455081][T15302] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:36 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000fffffff0000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 971.499902][T15302] team0: left allmulticast mode [ 971.505067][T15302] team0: left promiscuous mode [ 971.520677][T15302] bridge0: port 1(team0) entered disabled state [ 971.541725][T15302] batman_adv: batadv0: Adding interface: team0 [ 971.541738][T15302] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 971.541825][T15302] batman_adv: batadv0: Interface activated: team0 [ 971.542699][T15302] batman_adv: batadv0: Interface deactivated: team0 [ 971.575364][T15312] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 971.575389][T15312] batman_adv: batadv0: Removing interface: team0 [ 971.584770][T15312] bridge0: port 1(team0) entered blocking state [ 971.584812][T15312] bridge0: port 1(team0) entered disabled state [ 971.584914][T15312] team0: entered allmulticast mode [ 971.585769][T15312] team0: entered promiscuous mode [ 971.587010][T15312] 8021q: adding VLAN 0 to HW filter on device team0 [ 971.614353][T15315] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:36 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:36 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:36 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 971.761440][T15311] netlink: 'syz-executor.4': attribute type 10 has an invalid length. 03:29:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000088a8ffff000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 971.761489][T15311] team0: left allmulticast mode 03:29:36 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 971.761507][T15311] team_slave_0: left allmulticast mode [ 971.761527][T15311] team_slave_1: left allmulticast mode [ 971.761602][T15311] team0: left promiscuous mode [ 971.761612][T15311] team_slave_0: left promiscuous mode [ 971.761702][T15311] team_slave_1: left promiscuous mode [ 971.761861][T15311] bridge0: port 3(team0) entered disabled state [ 971.848965][T15311] batman_adv: batadv0: Adding interface: team0 [ 971.848985][T15311] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:29:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000f0ffff000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 971.849044][T15311] batman_adv: batadv0: Interface activated: team0 03:29:37 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 971.854770][T15311] batman_adv: batadv0: Interface deactivated: team0 [ 971.909934][T15319] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 971.910063][T15319] batman_adv: batadv0: Removing interface: team0 [ 971.936577][T15319] bridge0: port 3(team0) entered blocking state [ 971.936681][T15319] bridge0: port 3(team0) entered disabled state [ 971.936959][T15319] team0: entered allmulticast mode [ 971.937016][T15319] team_slave_0: entered allmulticast mode [ 971.937039][T15319] team_slave_1: entered allmulticast mode [ 971.939112][T15319] team0: entered promiscuous mode [ 971.939157][T15319] team_slave_0: entered promiscuous mode [ 971.939361][T15319] team_slave_1: entered promiscuous mode [ 971.943996][T15319] bridge0: port 3(team0) entered blocking state [ 971.944054][T15319] bridge0: port 3(team0) entered forwarding state [ 971.944677][T15319] 8021q: adding VLAN 0 to HW filter on device team0 [ 971.995615][T15322] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 971.995663][T15322] team0: left allmulticast mode [ 971.995677][T15322] team0: left promiscuous mode [ 971.995800][T15322] bridge0: port 1(team0) entered disabled state [ 972.004918][T15322] batman_adv: batadv0: Adding interface: team0 [ 972.004931][T15322] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 972.005021][T15322] batman_adv: batadv0: Interface activated: team0 [ 972.005764][T15322] batman_adv: batadv0: Interface deactivated: team0 [ 972.012683][T15322] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 972.012703][T15322] batman_adv: batadv0: Removing interface: team0 [ 972.013929][T15322] bridge0: port 1(team0) entered blocking state [ 972.014395][T15322] bridge0: port 1(team0) entered disabled state [ 972.014480][T15322] team0: entered allmulticast mode [ 972.017776][T15322] team0: entered promiscuous mode [ 972.019186][T15322] 8021q: adding VLAN 0 to HW filter on device team0 [ 972.352054][T15327] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 972.683582][T15335] team0: left allmulticast mode [ 972.683600][T15335] team0: left promiscuous mode [ 972.683708][T15335] bridge0: port 1(team0) entered disabled state [ 972.826824][T15335] batman_adv: batadv0: Adding interface: team0 [ 972.826839][T15335] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 972.826927][T15335] batman_adv: batadv0: Interface activated: team0 [ 972.832874][T15335] batman_adv: batadv0: Interface deactivated: team0 [ 972.842054][T15337] batman_adv: batadv0: Removing interface: team0 [ 972.843845][T15337] bridge0: port 1(team0) entered blocking state [ 972.844002][T15337] bridge0: port 1(team0) entered disabled state [ 972.844130][T15337] team0: entered allmulticast mode 03:29:37 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x0, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:37 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:37 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000007fffffff000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:37 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:37 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 972.845495][T15337] team0: entered promiscuous mode [ 972.848201][T15337] 8021q: adding VLAN 0 to HW filter on device team0 03:29:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000009effffff000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 973.416598][T15349] team0: left allmulticast mode 03:29:38 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000f0ffffff000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:38 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440), 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 973.691845][T15349] team0: left promiscuous mode [ 973.692029][T15349] bridge0: port 1(team0) entered disabled state [ 973.736495][T15349] batman_adv: batadv0: Adding interface: team0 [ 973.736508][T15349] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 973.737376][T15349] batman_adv: batadv0: Interface activated: team0 [ 973.738611][T15349] batman_adv: batadv0: Interface deactivated: team0 [ 973.790919][T15360] batman_adv: batadv0: Removing interface: team0 [ 974.036176][T15360] bridge0: port 1(team0) entered blocking state [ 974.055919][T15360] bridge0: port 1(team0) entered disabled state [ 974.068668][T15360] team0: entered allmulticast mode [ 974.096695][T15360] team0: entered promiscuous mode [ 974.117751][T15360] 8021q: adding VLAN 0 to HW filter on device team0 [ 974.125973][T15361] team0: left allmulticast mode [ 974.132143][T15361] team_slave_0: left allmulticast mode [ 974.143251][T15361] team_slave_1: left allmulticast mode [ 974.154088][T15361] team0: left promiscuous mode [ 974.159800][T15361] team_slave_0: left promiscuous mode 03:29:38 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:38 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 974.177395][T15361] team_slave_1: left promiscuous mode [ 974.217085][T15361] bridge0: port 3(team0) entered disabled state [ 974.335375][T15361] batman_adv: batadv0: Adding interface: team0 [ 974.341914][T15361] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 974.645161][T15361] batman_adv: batadv0: Interface activated: team0 [ 974.654575][T15361] batman_adv: batadv0: Interface deactivated: team0 [ 974.679551][T15366] batman_adv: batadv0: Removing interface: team0 [ 974.692971][T15366] bridge0: port 3(team0) entered blocking state [ 974.703057][T15366] bridge0: port 3(team0) entered disabled state [ 974.709561][T15366] team0: entered allmulticast mode [ 974.718089][T15366] team_slave_0: entered allmulticast mode [ 974.727371][T15366] team_slave_1: entered allmulticast mode [ 974.738071][T15366] team0: entered promiscuous mode [ 974.745077][T15366] team_slave_0: entered promiscuous mode [ 974.765469][T15366] team_slave_1: entered promiscuous mode [ 974.775872][T15366] bridge0: port 3(team0) entered blocking state [ 974.782489][T15366] bridge0: port 3(team0) entered forwarding state 03:29:39 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000020000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 974.790384][T15366] 8021q: adding VLAN 0 to HW filter on device team0 [ 974.807774][T15369] team0: left allmulticast mode [ 974.814332][T15369] team0: left promiscuous mode [ 974.836176][T15369] bridge0: port 1(team0) entered disabled state [ 974.897604][T15369] batman_adv: batadv0: Adding interface: team0 [ 974.905917][T15369] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 974.936287][T15369] batman_adv: batadv0: Interface activated: team0 [ 974.947461][T15369] batman_adv: batadv0: Interface deactivated: team0 [ 974.983692][T15376] batman_adv: batadv0: Removing interface: team0 [ 974.995859][T15376] bridge0: port 1(team0) entered blocking state [ 975.011689][T15376] bridge0: port 1(team0) entered disabled state [ 975.020397][T15376] team0: entered allmulticast mode [ 975.029183][T15376] team0: entered promiscuous mode [ 975.039495][T15376] 8021q: adding VLAN 0 to HW filter on device team0 03:29:41 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:41 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{0x0}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:41 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000030000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:41 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:41 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:41 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x0, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:41 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000040000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 977.250563][T15391] validate_nla: 11 callbacks suppressed [ 977.542341][T15391] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 977.542415][T15391] team0: left allmulticast mode [ 977.542438][T15391] team0: left promiscuous mode [ 977.544850][T15391] bridge0: port 1(team0) entered disabled state 03:29:42 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{0x0}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:42 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000050000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 977.623127][T15391] batman_adv: batadv0: Adding interface: team0 [ 977.623141][T15391] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 977.623230][T15391] batman_adv: batadv0: Interface activated: team0 [ 977.625847][T15391] batman_adv: batadv0: Interface deactivated: team0 03:29:42 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 977.636935][T15389] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 977.637072][T15398] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 977.637139][T15398] batman_adv: batadv0: Removing interface: team0 [ 977.639370][T15398] bridge0: port 1(team0) entered blocking state [ 977.639446][T15398] bridge0: port 1(team0) entered disabled state [ 977.639609][T15398] team0: entered allmulticast mode [ 977.645581][T15398] team0: entered promiscuous mode [ 977.647930][T15398] 8021q: adding VLAN 0 to HW filter on device team0 [ 977.648566][T15400] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 977.648865][T15400] team0: left allmulticast mode [ 977.648885][T15400] team_slave_0: left allmulticast mode [ 977.648977][T15400] team_slave_1: left allmulticast mode [ 977.649405][T15400] team0: left promiscuous mode [ 977.649425][T15400] team_slave_0: left promiscuous mode [ 977.649774][T15400] team_slave_1: left promiscuous mode 03:29:42 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 977.650435][T15400] bridge0: port 3(team0) entered disabled state [ 977.674540][T15400] batman_adv: batadv0: Adding interface: team0 [ 977.674559][T15400] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:29:42 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000060000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 977.674632][T15400] batman_adv: batadv0: Interface activated: team0 [ 977.676423][T15400] batman_adv: batadv0: Interface deactivated: team0 [ 978.092339][T15403] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 978.092404][T15403] batman_adv: batadv0: Removing interface: team0 03:29:43 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:43 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{0x0}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:43 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:43 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000070000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 978.097185][T15403] bridge0: port 3(team0) entered blocking state [ 978.097225][T15403] bridge0: port 3(team0) entered disabled state [ 978.097314][T15403] team0: entered allmulticast mode [ 978.097325][T15403] team_slave_0: entered allmulticast mode [ 978.097336][T15403] team_slave_1: entered allmulticast mode [ 978.098025][T15403] team0: entered promiscuous mode [ 978.098037][T15403] team_slave_0: entered promiscuous mode [ 978.098121][T15403] team_slave_1: entered promiscuous mode 03:29:43 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000080000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 978.099546][T15403] bridge0: port 3(team0) entered blocking state [ 978.099590][T15403] bridge0: port 3(team0) entered forwarding state [ 978.099701][T15403] 8021q: adding VLAN 0 to HW filter on device team0 [ 978.165403][T15408] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 978.214004][T15409] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 978.214052][T15409] team0: left allmulticast mode [ 978.214066][T15409] team0: left promiscuous mode [ 978.214172][T15409] bridge0: port 1(team0) entered disabled state [ 978.235694][T15409] batman_adv: batadv0: Adding interface: team0 [ 978.235708][T15409] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 978.235794][T15409] batman_adv: batadv0: Interface activated: team0 [ 978.236378][T15409] batman_adv: batadv0: Interface deactivated: team0 [ 978.244323][T15409] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 978.244346][T15409] batman_adv: batadv0: Removing interface: team0 [ 978.248140][T15409] bridge0: port 1(team0) entered blocking state [ 978.248184][T15409] bridge0: port 1(team0) entered disabled state [ 978.248252][T15409] team0: entered allmulticast mode [ 978.248854][T15409] team0: entered promiscuous mode [ 978.249812][T15409] 8021q: adding VLAN 0 to HW filter on device team0 [ 978.748836][T15418] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 978.748949][T15422] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 978.749008][T15422] team0: left allmulticast mode [ 978.749090][T15422] team0: left promiscuous mode [ 978.749238][T15422] bridge0: port 1(team0) entered disabled state [ 978.754852][T15422] batman_adv: batadv0: Adding interface: team0 [ 978.754866][T15422] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 978.755032][T15422] batman_adv: batadv0: Interface activated: team0 [ 978.756996][T15422] batman_adv: batadv0: Interface deactivated: team0 [ 978.779263][T15422] batman_adv: batadv0: Removing interface: team0 [ 978.788073][T15422] bridge0: port 1(team0) entered blocking state [ 979.001976][T15422] bridge0: port 1(team0) entered disabled state [ 979.020879][T15422] team0: entered allmulticast mode [ 979.043047][T15422] team0: entered promiscuous mode [ 979.052087][T15422] 8021q: adding VLAN 0 to HW filter on device team0 [ 979.097944][T15428] team0: left allmulticast mode [ 979.113415][T15428] team_slave_0: left allmulticast mode [ 979.128065][T15428] team_slave_1: left allmulticast mode [ 979.140892][T15428] team0: left promiscuous mode [ 979.147765][T15428] team_slave_0: left promiscuous mode [ 979.163600][T15428] team_slave_1: left promiscuous mode [ 979.174119][T15428] bridge0: port 3(team0) entered disabled state [ 979.193056][T15428] batman_adv: batadv0: Adding interface: team0 [ 979.199560][T15428] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 979.228518][T15428] batman_adv: batadv0: Interface activated: team0 [ 979.238535][T15428] batman_adv: batadv0: Interface deactivated: team0 [ 979.260673][T15425] batman_adv: batadv0: Removing interface: team0 [ 979.273461][T15425] bridge0: port 3(team0) entered blocking state [ 979.279910][T15425] bridge0: port 3(team0) entered disabled state [ 979.286763][T15425] team0: entered allmulticast mode [ 979.292369][T15425] team_slave_0: entered allmulticast mode [ 979.298131][T15425] team_slave_1: entered allmulticast mode [ 979.309785][T15425] team0: entered promiscuous mode [ 979.315234][T15425] team_slave_0: entered promiscuous mode [ 979.321353][T15425] team_slave_1: entered promiscuous mode [ 979.330424][T15425] bridge0: port 3(team0) entered blocking state [ 979.336807][T15425] bridge0: port 3(team0) entered forwarding state [ 979.346043][T15425] 8021q: adding VLAN 0 to HW filter on device team0 03:29:44 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x0, 0x91, &(0x7f0000000000)=""/145, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:44 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:44 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:44 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000090000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:44 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:44 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:45 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:45 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000a0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 980.466113][T15435] team0: left allmulticast mode [ 980.487253][T15435] team0: left promiscuous mode [ 980.506991][T15435] bridge0: port 1(team0) entered disabled state [ 980.819527][T15435] batman_adv: batadv0: Adding interface: team0 [ 980.829149][T15435] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 980.856922][T15435] batman_adv: batadv0: Interface activated: team0 [ 980.867143][T15435] batman_adv: batadv0: Interface deactivated: team0 [ 980.877225][T15438] team0: left allmulticast mode [ 980.883546][T15438] team_slave_0: left allmulticast mode [ 980.890314][T15438] team_slave_1: left allmulticast mode [ 980.903808][T15438] team0: left promiscuous mode [ 980.908889][T15438] team_slave_0: left promiscuous mode [ 980.917762][T15438] team_slave_1: left promiscuous mode [ 980.925569][T15438] bridge0: port 3(team0) entered disabled state [ 980.938761][T15438] batman_adv: batadv0: Adding interface: team0 [ 980.948401][T15438] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 980.978573][T15438] batman_adv: batadv0: Interface activated: team0 [ 980.988394][T15438] batman_adv: batadv0: Interface deactivated: team0 [ 981.022389][T15442] batman_adv: batadv0: Removing interface: team0 [ 981.043180][T15442] bridge0: port 1(team0) entered blocking state [ 981.060751][T15442] bridge0: port 1(team0) entered disabled state [ 981.067703][T15442] team0: entered allmulticast mode 03:29:45 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:45 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000c0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 981.086352][T15442] team0: entered promiscuous mode [ 981.096543][T15442] 8021q: adding VLAN 0 to HW filter on device team0 [ 981.108062][T15451] batman_adv: batadv0: Removing interface: team0 03:29:45 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r2, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 981.143965][T15451] bridge0: port 3(team0) entered blocking state [ 981.153752][T15451] bridge0: port 3(team0) entered disabled state [ 981.182709][T15451] team0: entered allmulticast mode [ 981.188261][T15451] team_slave_0: entered allmulticast mode [ 981.194525][T15451] team_slave_1: entered allmulticast mode 03:29:45 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 981.235433][T15451] team0: entered promiscuous mode [ 981.241581][T15451] team_slave_0: entered promiscuous mode [ 981.255844][T15451] team_slave_1: entered promiscuous mode [ 981.266884][T15451] bridge0: port 3(team0) entered blocking state [ 981.273312][T15451] bridge0: port 3(team0) entered forwarding state [ 981.297719][T15451] 8021q: adding VLAN 0 to HW filter on device team0 [ 981.355041][T15457] team0: left allmulticast mode [ 981.367006][T15457] team0: left promiscuous mode [ 981.381142][T15457] bridge0: port 1(team0) entered disabled state [ 981.404951][T15457] batman_adv: batadv0: Adding interface: team0 [ 981.411805][T15457] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 981.438196][T15457] batman_adv: batadv0: Interface activated: team0 [ 981.451961][T15457] batman_adv: batadv0: Interface deactivated: team0 [ 981.731424][T15459] batman_adv: batadv0: Removing interface: team0 [ 981.744308][T15459] bridge0: port 1(team0) entered blocking state [ 981.750880][T15459] bridge0: port 1(team0) entered disabled state [ 981.757388][T15459] team0: entered allmulticast mode [ 981.767080][T15459] team0: entered promiscuous mode [ 981.774888][T15459] 8021q: adding VLAN 0 to HW filter on device team0 03:29:47 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:47 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:47 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000e0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:47 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:47 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r1, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:47 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(0x0, 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:47 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000f0000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 983.058392][T15476] validate_nla: 12 callbacks suppressed [ 983.058411][T15476] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 983.210271][T15476] team0: left allmulticast mode [ 983.217824][T15476] team0: left promiscuous mode [ 983.247700][T15476] bridge0: port 1(team0) entered disabled state [ 983.296639][T15476] batman_adv: batadv0: Adding interface: team0 [ 983.316668][T15476] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 983.365228][T15476] batman_adv: batadv0: Interface activated: team0 [ 983.383896][T15476] batman_adv: batadv0: Interface deactivated: team0 [ 983.421934][T15483] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 983.437712][T15483] team0: left allmulticast mode [ 983.454667][T15483] team_slave_0: left allmulticast mode [ 983.469217][T15483] team_slave_1: left allmulticast mode [ 983.483656][T15483] team0: left promiscuous mode [ 983.488929][T15483] team_slave_0: left promiscuous mode [ 983.508617][T15483] team_slave_1: left promiscuous mode [ 983.525035][T15483] bridge0: port 3(team0) entered disabled state [ 983.555271][T15483] batman_adv: batadv0: Adding interface: team0 [ 983.563180][T15483] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 983.589236][T15483] batman_adv: batadv0: Interface activated: team0 [ 983.597815][T15483] batman_adv: batadv0: Interface deactivated: team0 [ 983.624052][T15484] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 983.632961][T15484] batman_adv: batadv0: Removing interface: team0 [ 983.643588][T15484] bridge0: port 1(team0) entered blocking state [ 983.650398][T15484] bridge0: port 1(team0) entered disabled state [ 983.657390][T15484] team0: entered allmulticast mode [ 983.666859][T15484] team0: entered promiscuous mode 03:29:48 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r1, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 983.674039][T15484] 8021q: adding VLAN 0 to HW filter on device team0 [ 983.682131][T15485] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 983.696367][T15475] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 983.707660][T15475] batman_adv: batadv0: Removing interface: team0 [ 983.743438][T15475] bridge0: port 3(team0) entered blocking state [ 983.763559][T15475] bridge0: port 3(team0) entered disabled state [ 983.781023][T15475] team0: entered allmulticast mode [ 983.786326][T15475] team_slave_0: entered allmulticast mode 03:29:48 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(0x0, 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 983.793265][T15475] team_slave_1: entered allmulticast mode [ 983.800260][T15475] team0: entered promiscuous mode [ 983.806315][T15475] team_slave_0: entered promiscuous mode [ 983.813343][T15475] team_slave_1: entered promiscuous mode [ 983.821270][T15475] bridge0: port 3(team0) entered blocking state [ 983.827703][T15475] bridge0: port 3(team0) entered forwarding state [ 983.834856][T15475] 8021q: adding VLAN 0 to HW filter on device team0 03:29:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000100000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 983.868609][T15493] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 983.906600][T15492] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:29:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 983.925751][T15492] team0: left allmulticast mode [ 983.931257][T15492] team0: left promiscuous mode [ 983.936522][T15492] bridge0: port 1(team0) entered disabled state [ 983.947078][T15492] batman_adv: batadv0: Adding interface: team0 [ 983.964114][T15492] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 984.001814][T15492] batman_adv: batadv0: Interface activated: team0 [ 984.022415][T15492] batman_adv: batadv0: Interface deactivated: team0 [ 984.042618][T15494] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 984.057143][T15494] batman_adv: batadv0: Removing interface: team0 [ 984.074272][T15494] bridge0: port 1(team0) entered blocking state [ 984.081231][T15494] bridge0: port 1(team0) entered disabled state [ 984.087953][T15494] team0: entered allmulticast mode [ 984.095197][T15494] team0: entered promiscuous mode [ 984.128387][T15494] 8021q: adding VLAN 0 to HW filter on device team0 [ 984.286822][T15499] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:50 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:50 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000600000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:50 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r1, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:50 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:50 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(0x0, 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000f00000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 985.532156][T15513] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 985.559487][T15513] team0: left allmulticast mode [ 985.567546][T15513] team0: left promiscuous mode [ 985.587953][T15513] bridge0: port 1(team0) entered disabled state [ 985.748568][T15513] batman_adv: batadv0: Adding interface: team0 [ 985.768997][T15513] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 985.850010][T15513] batman_adv: batadv0: Interface activated: team0 [ 985.870212][T15513] batman_adv: batadv0: Interface deactivated: team0 03:29:50 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 985.991635][T15514] team0: left allmulticast mode [ 986.010286][T15514] team_slave_0: left allmulticast mode [ 986.016276][T15514] team_slave_1: left allmulticast mode [ 986.027813][T15514] team0: left promiscuous mode [ 986.033073][T15514] team_slave_0: left promiscuous mode [ 986.039265][T15514] team_slave_1: left promiscuous mode [ 986.052689][T15514] bridge0: port 3(team0) entered disabled state [ 986.070529][T15514] batman_adv: batadv0: Adding interface: team0 [ 986.077932][T15514] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 986.109874][T15514] batman_adv: batadv0: Interface activated: team0 [ 986.117655][T15514] batman_adv: batadv0: Interface deactivated: team0 [ 986.140861][T15521] batman_adv: batadv0: Removing interface: team0 [ 986.151856][T15521] bridge0: port 3(team0) entered blocking state [ 986.158542][T15521] bridge0: port 3(team0) entered disabled state [ 986.165783][T15521] team0: entered allmulticast mode [ 986.172525][T15521] team_slave_0: entered allmulticast mode [ 986.178534][T15521] team_slave_1: entered allmulticast mode [ 986.186093][T15521] team0: entered promiscuous mode [ 986.191845][T15521] team_slave_0: entered promiscuous mode [ 986.197894][T15521] team_slave_1: entered promiscuous mode [ 986.206498][T15521] bridge0: port 3(team0) entered blocking state [ 986.212954][T15521] bridge0: port 3(team0) entered forwarding state [ 986.222742][T15521] 8021q: adding VLAN 0 to HW filter on device team0 [ 986.230300][T15520] batman_adv: batadv0: Removing interface: team0 03:29:50 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:50 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000300000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 986.239728][T15520] bridge0: port 1(team0) entered blocking state [ 986.246663][T15520] bridge0: port 1(team0) entered disabled state [ 986.253591][T15520] team0: entered allmulticast mode [ 986.260254][T15520] team0: entered promiscuous mode [ 986.267555][T15520] 8021q: adding VLAN 0 to HW filter on device team0 03:29:50 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 986.465776][T15533] team0: left allmulticast mode [ 986.483876][T15533] team_slave_0: left allmulticast mode [ 986.496834][T15533] team_slave_1: left allmulticast mode [ 986.510530][T15533] team0: left promiscuous mode [ 986.516178][T15533] team_slave_0: left promiscuous mode [ 986.522371][T15533] team_slave_1: left promiscuous mode [ 986.528054][T15533] bridge0: port 3(team0) entered disabled state [ 986.538514][T15533] batman_adv: batadv0: Adding interface: team0 [ 986.544825][T15533] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 986.825520][T15533] batman_adv: batadv0: Interface activated: team0 [ 986.842721][T15533] batman_adv: batadv0: Interface deactivated: team0 [ 986.879857][T15538] batman_adv: batadv0: Removing interface: team0 [ 986.894421][T15538] bridge0: port 3(team0) entered blocking state [ 986.901313][T15538] bridge0: port 3(team0) entered disabled state [ 986.908723][T15538] team0: entered allmulticast mode [ 986.914738][T15538] team_slave_0: entered allmulticast mode [ 986.921032][T15538] team_slave_1: entered allmulticast mode [ 986.928549][T15538] team0: entered promiscuous mode [ 986.934049][T15538] team_slave_0: entered promiscuous mode [ 986.941117][T15538] team_slave_1: entered promiscuous mode [ 986.951214][T15538] bridge0: port 3(team0) entered blocking state [ 986.957549][T15538] bridge0: port 3(team0) entered forwarding state [ 986.964300][T15538] 8021q: adding VLAN 0 to HW filter on device team0 03:29:52 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:52 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:52 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffffff, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:52 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r5, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000a60300000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:52 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000500000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 988.131547][T15549] validate_nla: 8 callbacks suppressed [ 988.131564][T15549] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 988.352875][T15549] team0: left allmulticast mode [ 988.468837][T15549] team0: left promiscuous mode [ 988.474640][T15549] bridge0: port 1(team0) entered disabled state [ 988.485822][T15549] batman_adv: batadv0: Adding interface: team0 [ 988.492469][T15549] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 988.518699][T15549] batman_adv: batadv0: Interface activated: team0 [ 988.529371][T15549] batman_adv: batadv0: Interface deactivated: team0 [ 988.558116][T15551] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:53 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffffff, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 988.571732][T15552] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 988.583884][T15552] team0: left allmulticast mode [ 988.588834][T15552] team_slave_0: left allmulticast mode [ 988.594656][T15552] team_slave_1: left allmulticast mode [ 988.600219][T15552] team0: left promiscuous mode [ 988.607591][T15552] team_slave_0: left promiscuous mode [ 988.616544][T15552] team_slave_1: left promiscuous mode [ 988.628035][T15552] bridge0: port 3(team0) entered disabled state [ 988.641142][T15552] batman_adv: batadv0: Adding interface: team0 [ 988.648321][T15552] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 988.676510][T15552] batman_adv: batadv0: Interface activated: team0 [ 988.688239][T15552] batman_adv: batadv0: Interface deactivated: team0 [ 988.716471][T15562] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 988.725191][T15562] batman_adv: batadv0: Removing interface: team0 [ 988.756243][T15562] bridge0: port 1(team0) entered blocking state [ 988.762821][T15562] bridge0: port 1(team0) entered disabled state [ 988.769507][T15562] team0: entered allmulticast mode [ 988.783069][T15562] team0: entered promiscuous mode [ 988.789418][T15562] 8021q: adding VLAN 0 to HW filter on device team0 03:29:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000600000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:53 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 988.808243][T15561] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 988.818369][T15561] batman_adv: batadv0: Removing interface: team0 [ 988.845700][T15561] bridge0: port 3(team0) entered blocking state [ 988.862378][T15561] bridge0: port 3(team0) entered disabled state [ 988.869151][T15561] team0: entered allmulticast mode [ 988.876119][T15561] team_slave_0: entered allmulticast mode [ 988.882434][T15561] team_slave_1: entered allmulticast mode [ 988.898988][T15561] team0: entered promiscuous mode [ 988.905986][T15561] team_slave_0: entered promiscuous mode 03:29:53 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 988.915350][T15561] team_slave_1: entered promiscuous mode [ 988.926336][T15561] bridge0: port 3(team0) entered blocking state [ 988.932826][T15561] bridge0: port 3(team0) entered forwarding state [ 988.940042][T15561] 8021q: adding VLAN 0 to HW filter on device team0 03:29:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000700000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 988.973054][T15566] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 989.031207][T15570] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 989.071690][T15570] team0: left allmulticast mode [ 989.076781][T15570] team0: left promiscuous mode [ 989.087763][T15570] bridge0: port 1(team0) entered disabled state [ 989.122299][T15570] batman_adv: batadv0: Adding interface: team0 [ 989.128511][T15570] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 989.216153][T15570] batman_adv: batadv0: Interface activated: team0 [ 989.241893][T15570] batman_adv: batadv0: Interface deactivated: team0 [ 989.504276][T15571] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 989.514225][T15571] batman_adv: batadv0: Removing interface: team0 [ 989.523762][T15571] bridge0: port 1(team0) entered blocking state [ 989.530213][T15571] bridge0: port 1(team0) entered disabled state [ 989.537220][T15571] team0: entered allmulticast mode [ 989.543493][T15571] team0: entered promiscuous mode [ 989.552478][T15571] 8021q: adding VLAN 0 to HW filter on device team0 03:29:55 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:55 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:29:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000900000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:55 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffffff, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:55 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(0xffffffffffffffff, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000a00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 990.740524][T15584] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 990.769820][T15584] team0: left allmulticast mode [ 990.798040][T15584] team0: left promiscuous mode [ 990.809561][T15584] bridge0: port 1(team0) entered disabled state [ 990.829790][T15584] batman_adv: batadv0: Adding interface: team0 [ 990.981321][T15584] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:29:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x0, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 991.105153][T15584] batman_adv: batadv0: Interface activated: team0 [ 991.115848][T15584] batman_adv: batadv0: Interface deactivated: team0 [ 991.142225][T15588] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:29:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000c00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:55 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x0, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:55 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 991.142345][T15587] team0: left allmulticast mode [ 991.142358][T15587] team_slave_0: left allmulticast mode [ 991.142370][T15587] team_slave_1: left allmulticast mode [ 991.142388][T15587] team0: left promiscuous mode [ 991.142397][T15587] team_slave_0: left promiscuous mode [ 991.142484][T15587] team_slave_1: left promiscuous mode [ 991.142642][T15587] bridge0: port 3(team0) entered disabled state [ 991.172567][T15587] batman_adv: batadv0: Adding interface: team0 [ 991.172586][T15587] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 991.172652][T15587] batman_adv: batadv0: Interface activated: team0 [ 991.173221][T15587] batman_adv: batadv0: Interface deactivated: team0 [ 991.207546][T15595] batman_adv: batadv0: Removing interface: team0 [ 991.218111][T15595] bridge0: port 1(team0) entered blocking state [ 991.218153][T15595] bridge0: port 1(team0) entered disabled state [ 991.218233][T15595] team0: entered allmulticast mode [ 991.220095][T15595] team0: entered promiscuous mode [ 991.244925][T15595] 8021q: adding VLAN 0 to HW filter on device team0 [ 991.391346][T15612] team0: left allmulticast mode [ 991.391386][T15612] team0: left promiscuous mode [ 991.391594][T15612] bridge0: port 1(team0) entered disabled state [ 991.399918][T15612] batman_adv: batadv0: Adding interface: team0 [ 991.399938][T15612] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 991.400098][T15612] batman_adv: batadv0: Interface activated: team0 [ 991.411114][T15612] batman_adv: batadv0: Interface deactivated: team0 [ 991.420146][T15612] batman_adv: batadv0: Removing interface: team0 03:29:56 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x0, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000e00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:56 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:56 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 991.422772][T15612] bridge0: port 1(team0) entered blocking state [ 991.439412][T15612] bridge0: port 1(team0) entered disabled state [ 991.439537][T15612] team0: entered allmulticast mode [ 991.442429][T15612] team0: entered promiscuous mode [ 991.443378][T15612] 8021q: adding VLAN 0 to HW filter on device team0 03:29:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000f00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 991.801480][T15623] team0: left allmulticast mode [ 991.801510][T15623] team0: left promiscuous mode [ 991.801672][T15623] bridge0: port 1(team0) entered disabled state 03:29:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:56 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000655800000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 991.920257][T15623] batman_adv: batadv0: Adding interface: team0 [ 991.920277][T15623] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 991.920447][T15623] batman_adv: batadv0: Interface activated: team0 [ 991.924457][T15623] batman_adv: batadv0: Interface deactivated: team0 [ 992.220830][T15629] batman_adv: batadv0: Removing interface: team0 [ 992.223303][T15629] bridge0: port 1(team0) entered blocking state [ 992.223592][T15629] bridge0: port 1(team0) entered disabled state [ 992.223819][T15629] team0: entered allmulticast mode [ 992.225150][T15629] team0: entered promiscuous mode [ 992.232862][T15629] 8021q: adding VLAN 0 to HW filter on device team0 [ 992.316963][T15642] team0: left allmulticast mode [ 992.316990][T15642] team0: left promiscuous mode [ 992.317156][T15642] bridge0: port 1(team0) entered disabled state [ 992.347063][T15642] batman_adv: batadv0: Adding interface: team0 [ 992.347084][T15642] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 992.347247][T15642] batman_adv: batadv0: Interface activated: team0 [ 992.348568][T15642] batman_adv: batadv0: Interface deactivated: team0 [ 992.395854][T15644] batman_adv: batadv0: Removing interface: team0 [ 992.399246][T15644] bridge0: port 1(team0) entered blocking state [ 992.399488][T15644] bridge0: port 1(team0) entered disabled state [ 992.399630][T15644] team0: entered allmulticast mode [ 992.409156][T15644] team0: entered promiscuous mode [ 992.412877][T15644] 8021q: adding VLAN 0 to HW filter on device team0 03:29:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000006000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:57 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:57 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:29:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000586500000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:57 executing program 1: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:57 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 992.699953][T15651] team0: left allmulticast mode [ 992.725550][T15651] team0: left promiscuous mode [ 992.742961][T15651] bridge0: port 1(team0) entered disabled state [ 992.772839][T15651] batman_adv: batadv0: Adding interface: team0 [ 992.784699][T15651] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 993.072623][T15651] batman_adv: batadv0: Interface activated: team0 [ 993.079642][ T1215] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.088494][ T1215] ieee802154 phy1 wpan1: encryption failed: -22 03:29:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:29:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000008100000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 993.163446][T15651] batman_adv: batadv0: Interface deactivated: team0 [ 993.223755][T15649] validate_nla: 13 callbacks suppressed [ 993.223774][T15649] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 993.243686][T15661] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 993.243722][T15661] batman_adv: batadv0: Removing interface: team0 [ 993.260081][T15661] bridge0: port 1(team0) entered blocking state [ 993.289957][T15661] bridge0: port 1(team0) entered disabled state [ 993.297923][T15661] team0: entered allmulticast mode 03:29:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000003a600000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:29:57 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:29:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 993.305822][T15661] team0: entered promiscuous mode [ 993.312854][T15661] 8021q: adding VLAN 0 to HW filter on device team0 [ 993.362175][T15672] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 993.427330][T15677] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 993.427398][T15677] team0: left allmulticast mode [ 993.427421][T15677] team0: left promiscuous mode [ 993.427597][T15677] bridge0: port 1(team0) entered disabled state [ 993.433848][T15677] batman_adv: batadv0: Adding interface: team0 [ 993.433868][T15677] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 993.434029][T15677] batman_adv: batadv0: Interface activated: team0 [ 993.435078][T15677] batman_adv: batadv0: Interface deactivated: team0 [ 993.492566][T15677] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 993.492621][T15677] batman_adv: batadv0: Removing interface: team0 [ 993.494741][T15677] bridge0: port 1(team0) entered blocking state [ 993.494949][T15677] bridge0: port 1(team0) entered disabled state [ 993.495078][T15677] team0: entered allmulticast mode [ 993.496255][T15677] team0: entered promiscuous mode [ 993.497744][T15677] 8021q: adding VLAN 0 to HW filter on device team0 [ 993.517999][T15680] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:00 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:00 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000f000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:00 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:00 executing program 1: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:00 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:00 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:01 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000004003000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:01 executing program 1: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:01 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 996.875776][T15698] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:01 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000340000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:01 executing program 1: r0 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:01 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 997.015969][T15716] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 997.131808][T15720] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:01 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r0, r0, 0x0, 0x7f06) unlinkat(r0, &(0x7f0000000340)='./file0\x00', 0x0) r1 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r2 = openat$cgroup_procs(r1, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r1, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:01 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:01 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000fffff0000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:01 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:01 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:01 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 997.334731][T15729] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:01 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000010080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:01 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r2, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r3 = dup(0xffffffffffffffff) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r3, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:02 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:02 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000020080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:02 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:02 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:02 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000030080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:02 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:02 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 998.235545][T15765] validate_nla: 5 callbacks suppressed [ 998.235563][T15765] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:05 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:05 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000040080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:05 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:05 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:05 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1001.160021][T15777] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:05 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:05 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:05 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000050080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:06 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1001.592778][T15789] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:06 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1001.636545][T15792] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1001.656501][T15792] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1001.665499][T15792] batman_adv: batadv0: Removing interface: team0 [ 1001.703062][T15792] bridge0: port 3(team0) entered blocking state [ 1001.725435][T15792] bridge0: port 3(team0) entered disabled state [ 1001.734447][T15792] team0: entered allmulticast mode [ 1001.749620][T15792] team_slave_0: entered allmulticast mode 03:30:06 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1001.756819][T15792] team_slave_1: entered allmulticast mode [ 1001.769468][T15792] team0: entered promiscuous mode [ 1001.801219][T15792] team_slave_0: entered promiscuous mode [ 1001.808237][T15792] team_slave_1: entered promiscuous mode [ 1001.828039][T15792] bridge0: port 3(team0) entered blocking state [ 1001.834437][T15792] bridge0: port 3(team0) entered forwarding state [ 1001.841695][T15792] 8021q: adding VLAN 0 to HW filter on device team0 [ 1001.861488][T15800] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:06 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:06 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x0) 03:30:06 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:06 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000060080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:06 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1002.109913][T15807] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:07 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000050080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000070080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:07 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x0) 03:30:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000080080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x0) [ 1002.550716][T15822] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:07 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1002.705660][T15831] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:07 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000090080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:07 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) 03:30:07 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) 03:30:07 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000a0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:07 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000c0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1003.030158][T15841] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1003.056614][T15841] team0: left allmulticast mode [ 1003.066038][T15841] team_slave_0: left allmulticast mode [ 1003.075424][T15841] team_slave_1: left allmulticast mode [ 1003.081418][T15841] team0: left promiscuous mode [ 1003.086733][T15841] team_slave_0: left promiscuous mode [ 1003.093381][T15841] team_slave_1: left promiscuous mode [ 1003.101392][T15841] bridge0: port 3(team0) entered disabled state 03:30:07 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 1003.216281][T15841] batman_adv: batadv0: Adding interface: team0 [ 1003.222995][T15841] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:30:08 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) [ 1003.516096][T15841] batman_adv: batadv0: Interface activated: team0 [ 1003.535135][T15841] batman_adv: batadv0: Interface deactivated: team0 03:30:08 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) [ 1003.599055][T15846] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1003.607953][T15846] batman_adv: batadv0: Removing interface: team0 [ 1003.653559][T15846] bridge0: port 3(team0) entered blocking state [ 1003.660339][T15846] bridge0: port 3(team0) entered disabled state [ 1003.668985][T15846] team0: entered allmulticast mode [ 1003.680038][T15846] team_slave_0: entered allmulticast mode [ 1003.686289][T15846] team_slave_1: entered allmulticast mode 03:30:08 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) [ 1003.699673][T15846] team0: entered promiscuous mode [ 1003.705310][T15846] team_slave_0: entered promiscuous mode [ 1003.716173][T15846] team_slave_1: entered promiscuous mode [ 1003.738305][T15846] bridge0: port 3(team0) entered blocking state [ 1003.744744][T15846] bridge0: port 3(team0) entered forwarding state [ 1003.755100][T15846] 8021q: adding VLAN 0 to HW filter on device team0 [ 1003.762769][T15848] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:09 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:09 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:09 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000e0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:09 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)}, 0x0) 03:30:09 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) 03:30:09 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000f0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:09 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) [ 1005.383212][T15873] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:10 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:10 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000100080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:10 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) [ 1005.785488][T15889] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:10 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1005.850890][T15882] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1005.864051][T15882] team0: left allmulticast mode [ 1005.869281][T15882] team_slave_0: left allmulticast mode [ 1005.890789][T15882] team_slave_1: left allmulticast mode [ 1005.951649][T15882] team0: left promiscuous mode [ 1005.956623][T15882] team_slave_0: left promiscuous mode [ 1005.964128][T15882] team_slave_1: left promiscuous mode [ 1005.973277][T15882] bridge0: port 3(team0) entered disabled state [ 1005.991064][T15882] batman_adv: batadv0: Adding interface: team0 [ 1005.997601][T15882] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1006.023997][T15882] batman_adv: batadv0: Interface activated: team0 [ 1006.038278][T15882] batman_adv: batadv0: Interface deactivated: team0 [ 1006.096041][T15891] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1006.111214][T15891] batman_adv: batadv0: Removing interface: team0 [ 1006.168568][T15891] bridge0: port 3(team0) entered blocking state [ 1006.209202][T15891] bridge0: port 3(team0) entered disabled state [ 1006.237634][T15891] team0: entered allmulticast mode [ 1006.244546][T15891] team_slave_0: entered allmulticast mode [ 1006.252097][T15891] team_slave_1: entered allmulticast mode [ 1006.263580][T15891] team0: entered promiscuous mode [ 1006.269954][T15891] team_slave_0: entered promiscuous mode [ 1006.278795][T15891] team_slave_1: entered promiscuous mode [ 1006.300390][T15891] bridge0: port 3(team0) entered blocking state [ 1006.306842][T15891] bridge0: port 3(team0) entered forwarding state [ 1006.394605][T15891] 8021q: adding VLAN 0 to HW filter on device team0 [ 1006.412014][T15898] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:11 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(0xffffffffffffffff, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:11 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) 03:30:11 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000600080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:11 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{0x0}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:11 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) 03:30:11 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:11 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000058650080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:11 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) 03:30:11 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:11 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000810080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:11 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) [ 1007.133570][T15921] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1007.154562][T15921] team0: left allmulticast mode [ 1007.171284][T15921] team_slave_0: left allmulticast mode 03:30:11 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) [ 1007.189473][T15921] team_slave_1: left allmulticast mode [ 1007.206453][T15921] team0: left promiscuous mode [ 1007.228171][T15921] team_slave_0: left promiscuous mode [ 1007.234370][T15921] team_slave_1: left promiscuous mode [ 1007.247620][T15921] bridge0: port 3(team0) entered disabled state [ 1007.296732][T15921] batman_adv: batadv0: Adding interface: team0 [ 1007.304161][T15921] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1007.331905][T15921] batman_adv: batadv0: Interface activated: team0 [ 1007.344032][T15921] batman_adv: batadv0: Interface deactivated: team0 [ 1007.374186][T15927] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:12 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(0xffffffffffffffff, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:12 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) 03:30:12 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000ffffa8880080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:12 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1007.441078][T15932] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1007.500339][T15932] batman_adv: batadv0: Removing interface: team0 [ 1007.537894][T15932] bridge0: port 3(team0) entered blocking state [ 1007.545120][T15932] bridge0: port 3(team0) entered disabled state [ 1007.553388][T15932] team0: entered allmulticast mode [ 1007.565823][T15932] team_slave_0: entered allmulticast mode [ 1007.575246][T15932] team_slave_1: entered allmulticast mode [ 1007.591487][T15932] team0: entered promiscuous mode [ 1007.597330][T15932] team_slave_0: entered promiscuous mode [ 1007.604550][T15932] team_slave_1: entered promiscuous mode [ 1007.936914][T15932] bridge0: port 3(team0) entered blocking state [ 1007.943376][T15932] bridge0: port 3(team0) entered forwarding state [ 1007.957475][T15932] 8021q: adding VLAN 0 to HW filter on device team0 03:30:12 executing program 4: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:14 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:14 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000ffffff9e0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:14 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) 03:30:14 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:14 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) 03:30:14 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(0xffffffffffffffff, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:14 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003a60080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:14 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) [ 1009.555482][T15958] validate_nla: 1 callbacks suppressed [ 1009.555499][T15958] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:14 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:14 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000fffffff00080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1009.938133][T15975] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:14 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:14 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) [ 1010.038245][T15974] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1010.093694][T15974] team0: left allmulticast mode [ 1010.098944][T15974] team_slave_0: left allmulticast mode [ 1010.118841][T15974] team_slave_1: left allmulticast mode [ 1010.125219][T15974] team0: left promiscuous mode [ 1010.136741][T15974] team_slave_0: left promiscuous mode [ 1010.144908][T15974] team_slave_1: left promiscuous mode [ 1010.151760][T15974] bridge0: port 3(team0) entered disabled state [ 1010.177812][T15974] batman_adv: batadv0: Adding interface: team0 [ 1010.184997][T15974] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1010.211021][T15974] batman_adv: batadv0: Interface activated: team0 [ 1010.241130][T15974] batman_adv: batadv0: Interface deactivated: team0 [ 1010.287586][T15977] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1010.297494][T15977] batman_adv: batadv0: Removing interface: team0 [ 1010.312782][T15977] bridge0: port 3(team0) entered blocking state [ 1010.319870][T15977] bridge0: port 3(team0) entered disabled state [ 1010.327573][T15977] team0: entered allmulticast mode [ 1010.333436][T15977] team_slave_0: entered allmulticast mode [ 1010.340410][T15977] team_slave_1: entered allmulticast mode [ 1010.374856][T15977] team0: entered promiscuous mode [ 1010.384873][T15977] team_slave_0: entered promiscuous mode [ 1010.393626][T15977] team_slave_1: entered promiscuous mode [ 1010.409323][T15977] bridge0: port 3(team0) entered blocking state [ 1010.415769][T15977] bridge0: port 3(team0) entered forwarding state [ 1010.426050][T15977] 8021q: adding VLAN 0 to HW filter on device team0 [ 1010.437788][T15980] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:16 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:16 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000088a8ffff0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:16 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) 03:30:16 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:16 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000", 0x17}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:16 executing program 4: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) ioctl$KDGETKEYCODE(r4, 0x4b4c, &(0x7f0000000080)={0x6, 0x3}) r5 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000001c0)=0x1000) writev(r0, &(0x7f00000001c0), 0x0) r6 = dup(r5) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r7, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.events\x00', 0x275a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup/syz1\x00', 0x1ff) 03:30:16 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) [ 1012.232636][T15992] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:17 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000f0ffff0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:17 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1012.613071][T16001] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1012.622867][T16001] team0: left allmulticast mode [ 1012.628936][T16001] team_slave_0: left allmulticast mode [ 1012.635663][T16001] team_slave_1: left allmulticast mode [ 1012.643007][T16001] team0: left promiscuous mode [ 1012.648992][T16001] team_slave_0: left promiscuous mode [ 1012.655110][T16001] team_slave_1: left promiscuous mode [ 1012.665187][T16001] bridge0: port 3(team0) entered disabled state [ 1012.687627][T16001] batman_adv: batadv0: Adding interface: team0 [ 1012.704267][T16001] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1012.731876][T16001] batman_adv: batadv0: Interface activated: team0 [ 1012.743689][T16001] batman_adv: batadv0: Interface deactivated: team0 03:30:17 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) [ 1012.807318][T16003] netlink: 'syz-executor.4': attribute type 10 has an invalid length. [ 1012.817072][T16003] batman_adv: batadv0: Removing interface: team0 [ 1012.861063][T16003] bridge0: port 3(team0) entered blocking state [ 1012.913084][T16003] bridge0: port 3(team0) entered disabled state 03:30:17 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) [ 1012.954553][T16003] team0: entered allmulticast mode [ 1012.959955][T16003] team_slave_0: entered allmulticast mode [ 1012.966318][T16003] team_slave_1: entered allmulticast mode [ 1012.988022][T16003] team0: entered promiscuous mode [ 1012.993433][T16003] team_slave_0: entered promiscuous mode [ 1013.002805][T16003] team_slave_1: entered promiscuous mode 03:30:17 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 1013.027180][T16003] bridge0: port 3(team0) entered blocking state [ 1013.033629][T16003] bridge0: port 3(team0) entered forwarding state [ 1013.177091][T16003] 8021q: adding VLAN 0 to HW filter on device team0 [ 1013.210709][T16010] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:19 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00'}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:19 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000007fffffff0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:19 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) 03:30:19 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:19 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) (fail_nth: 1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:19 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, 0xffffffffffffffff, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:19 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) [ 1014.871587][T16028] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1014.910839][T16029] FAULT_INJECTION: forcing a failure. 03:30:19 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a", 0x23}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1014.910839][T16029] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1015.022301][T16029] CPU: 0 PID: 16029 Comm: syz-executor.4 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1015.034001][T16029] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1015.044091][T16029] Call Trace: [ 1015.047392][T16029] [ 1015.050348][T16029] dump_stack_lvl+0x136/0x150 [ 1015.055193][T16029] should_fail_ex+0x4a3/0x5b0 [ 1015.059960][T16029] _copy_from_user+0x30/0x190 [ 1015.064724][T16029] __import_iovec+0x55f/0x880 [ 1015.069460][T16029] ? find_held_lock+0x2d/0x110 [ 1015.074279][T16029] import_iovec+0x110/0x160 [ 1015.078828][T16029] vfs_writev+0xc1/0x670 [ 1015.083148][T16029] ? vfs_iter_write+0xa0/0xa0 [ 1015.087869][T16029] ? __fget_files+0x248/0x480 [ 1015.092717][T16029] ? lock_downgrade+0x690/0x690 [ 1015.097611][T16029] ? trace_lock_acquire+0x12d/0x180 [ 1015.102848][T16029] ? vfs_write+0x4d0/0xe40 [ 1015.107307][T16029] ? receive_fd+0x110/0x110 [ 1015.111941][T16029] ? lock_acquire+0x32/0xc0 [ 1015.116491][T16029] ? receive_fd+0x110/0x110 [ 1015.121046][T16029] ? __fget_files+0x26a/0x480 [ 1015.125771][T16029] ? __fget_light+0xe5/0x270 [ 1015.130407][T16029] do_writev+0x133/0x2f0 [ 1015.134704][T16029] ? vfs_writev+0x670/0x670 [ 1015.139249][T16029] ? syscall_enter_from_user_mode+0x26/0x80 [ 1015.145239][T16029] do_syscall_64+0x39/0xb0 [ 1015.149785][T16029] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1015.155792][T16029] RIP: 0033:0x7fd10588c169 [ 1015.160326][T16029] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1015.180053][T16029] RSP: 002b:00007fd10668d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1015.188569][T16029] RAX: ffffffffffffffda RBX: 00007fd1059abf80 RCX: 00007fd10588c169 [ 1015.196578][T16029] RDX: 0000000000000001 RSI: 0000000020000440 RDI: 0000000000000003 [ 1015.204576][T16029] RBP: 00007fd10668d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1015.212574][T16029] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1015.220578][T16029] R13: 00007ffef9bb5d3f R14: 00007fd10668d300 R15: 0000000000022000 [ 1015.228600][T16029] 03:30:19 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000009effffff0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:19 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) 03:30:19 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1015.310245][T16042] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:19 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) (fail_nth: 2) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:20 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00'}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000f0ffffff0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:20 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) [ 1015.467149][T16050] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1015.479160][T16051] FAULT_INJECTION: forcing a failure. [ 1015.479160][T16051] name failslab, interval 1, probability 0, space 0, times 1 [ 1015.501489][T16051] CPU: 1 PID: 16051 Comm: syz-executor.4 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1015.513187][T16051] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1015.523366][T16051] Call Trace: [ 1015.526674][T16051] [ 1015.529649][T16051] dump_stack_lvl+0x136/0x150 [ 1015.534398][T16051] should_fail_ex+0x4a3/0x5b0 [ 1015.539141][T16051] should_failslab+0x9/0x20 [ 1015.543711][T16051] __kmem_cache_alloc_node+0x5b/0x320 [ 1015.549138][T16051] ? kvmalloc_node+0xa2/0x1a0 [ 1015.553877][T16051] ? mutex_trylock+0x2f4/0x370 [ 1015.558759][T16051] ? kvmalloc_node+0xa2/0x1a0 [ 1015.563556][T16051] __kmalloc_node+0x51/0x1a0 [ 1015.568179][T16051] kvmalloc_node+0xa2/0x1a0 [ 1015.572709][T16051] file_tty_write.constprop.0+0x71f/0x9c0 [ 1015.578476][T16051] ? n_tty_receive_signal_char+0x150/0x150 [ 1015.584309][T16051] do_iter_readv_writev+0x20b/0x3b0 [ 1015.589536][T16051] ? generic_copy_file_range+0x1d0/0x1d0 [ 1015.595200][T16051] ? bpf_lsm_file_permission+0x9/0x10 [ 1015.600621][T16051] ? security_file_permission+0xaf/0xd0 [ 1015.606223][T16051] do_iter_write+0x185/0x7e0 [ 1015.610847][T16051] vfs_writev+0x1aa/0x670 [ 1015.615289][T16051] ? vfs_iter_write+0xa0/0xa0 [ 1015.619993][T16051] ? __fget_files+0x248/0x480 [ 1015.624697][T16051] ? lock_downgrade+0x690/0x690 [ 1015.629580][T16051] ? receive_fd+0x110/0x110 [ 1015.634107][T16051] ? lock_acquire+0x32/0xc0 [ 1015.638719][T16051] ? receive_fd+0x110/0x110 [ 1015.643257][T16051] ? __fget_files+0x26a/0x480 [ 1015.648052][T16051] ? __fget_light+0xe5/0x270 [ 1015.652674][T16051] do_writev+0x133/0x2f0 [ 1015.656947][T16051] ? vfs_writev+0x670/0x670 [ 1015.661484][T16051] ? syscall_enter_from_user_mode+0x26/0x80 [ 1015.667404][T16051] do_syscall_64+0x39/0xb0 [ 1015.671844][T16051] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1015.677757][T16051] RIP: 0033:0x7fd10588c169 [ 1015.682185][T16051] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1015.701803][T16051] RSP: 002b:00007fd10668d168 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 1015.710234][T16051] RAX: ffffffffffffffda RBX: 00007fd1059abf80 RCX: 00007fd10588c169 03:30:20 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000200000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:20 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, 0x0, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) [ 1015.718222][T16051] RDX: 0000000000000001 RSI: 0000000020000440 RDI: 0000000000000003 [ 1015.726388][T16051] RBP: 00007fd10668d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1015.734377][T16051] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1015.742357][T16051] R13: 00007ffef9bb5d3f R14: 00007fd10668d300 R15: 0000000000022000 [ 1015.750359][T16051] 03:30:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000300000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:20 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002", 0x29}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1015.838493][T16061] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:20 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000400000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:20 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) (fail_nth: 3) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1015.987280][T16071] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:20 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) 03:30:20 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1016.298063][T16076] FAULT_INJECTION: forcing a failure. [ 1016.298063][T16076] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1016.340899][T16076] CPU: 0 PID: 16076 Comm: syz-executor.4 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1016.352870][T16076] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1016.362984][T16076] Call Trace: [ 1016.366290][T16076] [ 1016.368298][T16082] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1016.369229][T16076] dump_stack_lvl+0x136/0x150 [ 1016.382405][T16076] should_fail_ex+0x4a3/0x5b0 [ 1016.387221][T16076] _copy_to_user+0x30/0x160 [ 1016.391772][T16076] simple_read_from_buffer+0xd0/0x160 [ 1016.397198][T16076] proc_fail_nth_read+0x18b/0x220 [ 1016.402320][T16076] ? proc_fault_inject_read+0x220/0x220 [ 1016.407910][T16076] ? security_file_permission+0xaf/0xd0 [ 1016.413515][T16076] vfs_read+0x28d/0x960 [ 1016.417726][T16076] ? proc_fault_inject_read+0x220/0x220 [ 1016.423320][T16076] ? kernel_read+0x1c0/0x1c0 [ 1016.427966][T16076] ? receive_fd+0x110/0x110 [ 1016.432536][T16076] ? __fget_files+0x26a/0x480 [ 1016.437366][T16076] ksys_read+0x12b/0x250 [ 1016.441668][T16076] ? vfs_write+0xe40/0xe40 [ 1016.446143][T16076] ? syscall_enter_from_user_mode+0x26/0x80 [ 1016.452087][T16076] do_syscall_64+0x39/0xb0 [ 1016.456554][T16076] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1016.462494][T16076] RIP: 0033:0x7fd10583df8c [ 1016.467084][T16076] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1016.486923][T16076] RSP: 002b:00007fd10668d160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1016.495346][T16076] RAX: ffffffffffffffda RBX: 00007fd1059abf80 RCX: 00007fd10583df8c [ 1016.503339][T16076] RDX: 000000000000000f RSI: 00007fd10668d1e0 RDI: 0000000000000004 [ 1016.511334][T16076] RBP: 00007fd10668d1d0 R08: 0000000000000000 R09: 0000000000000000 [ 1016.519310][T16076] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1016.527470][T16076] R13: 00007ffef9bb5d3f R14: 00007fd10668d300 R15: 0000000000022000 [ 1016.535466][T16076] 03:30:21 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00'}, 0x10) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:21 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) 03:30:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:21 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000500000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:21 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000600000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1016.644687][T16089] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:21 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, 0x0, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:21 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) 03:30:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000", 0x2c}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:21 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000700000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:21 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:21 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 1) [ 1016.840317][T16101] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:21 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:21 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="08fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:21 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000800000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:21 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) [ 1017.132298][T16115] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:21 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1017.368890][T16118] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:22 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, 0x0, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:22 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000900000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:22 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="09fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:22 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000002, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:22 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a00140000000280000012", 0x2d}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:22 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:22 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000a00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:22 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:22 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="0afa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:22 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000003, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:22 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000c00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1017.938854][T16145] team0: left allmulticast mode [ 1017.938884][T16145] team0: left promiscuous mode [ 1017.939054][T16145] bridge0: port 1(team0) entered disabled state [ 1017.977770][T16145] batman_adv: batadv0: Adding interface: team0 03:30:22 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x14) [ 1017.977791][T16145] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1017.977958][T16145] batman_adv: batadv0: Interface activated: team0 [ 1017.979077][T16145] batman_adv: batadv0: Interface deactivated: team0 03:30:23 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240), 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:23 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x14) 03:30:23 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000004, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000e00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:23 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:23 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="0dfa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:23 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x14) 03:30:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000f00000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:23 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="32fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:23 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000005, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:23 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x14) 03:30:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000001000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:24 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240), 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:24 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="9bfa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:24 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x14) 03:30:24 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000006, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:24 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000006000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:24 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:24 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x14) 03:30:24 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000f000000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1019.918015][T16205] validate_nla: 11 callbacks suppressed [ 1019.918034][T16205] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:24 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000007, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:24 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:24 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)}, 0x14) [ 1019.947030][T16203] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1020.032051][T16214] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:24 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa071bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1020.434372][T16216] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1020.456375][T16226] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:25 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240), 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:25 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000009, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:25 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)}, 0x14) 03:30:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000a603000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa081bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:25 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:25 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa091bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000005000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:25 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00000f, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1020.961956][T16233] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1020.970277][T16239] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:25 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)}, 0x14) 03:30:25 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000006000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:25 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x14) [ 1021.136373][T16252] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1021.246802][T16258] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1021.529796][T16251] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:26 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x0) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:26 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x14) 03:30:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0a1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000007000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:26 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00002a, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:26 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{}]}) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:26 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000009000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:26 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{0x0}], 0x1}, 0x14) 03:30:26 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000048, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:26 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0c1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0d1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:27 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00004c, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:27 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x0) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000a000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:27 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1}, 0x14) 03:30:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0e1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:27 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000060, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:27 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0f1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000c000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:27 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1}, 0x14) 03:30:27 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000068, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:27 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)}], 0x1}, 0x14) 03:30:27 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa101bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:28 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef4100000", 0x17}], 0x1}, 0x14) 03:30:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000e000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:28 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa181bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:28 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00006c, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:28 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x0) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:28 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:28 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa1a1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000f000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:28 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef4100000", 0x17}], 0x1}, 0x14) 03:30:28 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000074, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:28 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef4100000", 0x17}], 0x1}, 0x14) 03:30:28 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa1b1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000006558000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:29 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00007a, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:29 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a", 0x23}], 0x1}, 0x14) 03:30:29 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa321bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:29 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(0x0, &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000060000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:29 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa9b1bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:29 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a", 0x23}], 0x1}, 0x14) 03:30:29 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f0000f0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:29 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:29 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0507bc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1025.007270][T16372] validate_nla: 17 callbacks suppressed [ 1025.007290][T16372] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:29 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000005865000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1025.099341][T16376] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:29 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a", 0x23}], 0x1}, 0x14) 03:30:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000300, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000081000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:30 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0508bc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1025.573939][T16395] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1025.630292][T16396] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:30 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(0x0, &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:30 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba", 0x29}], 0x1}, 0x14) 03:30:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000003a6000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:30 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0509bc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000500, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:30 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) [ 1025.953410][T16404] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000f0000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:30 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa050abc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:30 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000600, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1026.009718][T16410] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:30 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba", 0x29}], 0x1}, 0x14) [ 1026.139714][T16422] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:30 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000040030080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:31 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000700, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1026.553358][T16429] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1026.638710][T16432] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:31 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(0x0, &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:31 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba", 0x29}], 0x1}, 0x14) 03:30:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa050cbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003400080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:31 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000754, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:31 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000fffff00080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa050dbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1026.993959][T16444] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:31 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000900, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:31 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba800000", 0x2c}], 0x1}, 0x14) 03:30:31 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000180200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:31 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa050ebc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:32 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000f00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:32 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba800000", 0x2c}], 0x1}, 0x14) 03:30:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000280200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:32 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa050fbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:32 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9ca91a05703704c3772d9dfd1ebc0f6b4fd7d58ba1fd03d1cd550a416e8475ebfe12abd68d36176b8a7e08f857fc3490bd03", 0xc4}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r1 = dup(0xffffffffffffffff) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r1, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:32 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', 0x0, &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000380200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:32 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba800000", 0x2c}], 0x1}, 0x14) 03:30:32 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f001737, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:32 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0518bc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:32 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba80000012", 0x2d}], 0x1}, 0x14) 03:30:32 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000480200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:33 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', 0x0, &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:33 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051abc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:33 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba80000012", 0x2d}], 0x1}, 0x14) 03:30:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000580200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:33 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, 0x0, 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:33 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f001f00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:33 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa0532bc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000680200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:33 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba80000012", 0x2d}], 0x1}, 0x14) 03:30:33 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f002000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:33 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa059bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:33 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000780200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:34 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', 0x0, &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:34 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f002a00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0700b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:34 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x0) 03:30:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000880200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:34 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, 0x0, 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000980200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:34 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x0) [ 1030.035714][T16537] validate_nla: 12 callbacks suppressed [ 1030.035733][T16537] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0800b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:34 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f003717, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1030.092003][T16540] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:34 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0900b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:34 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000a80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1030.558489][T16552] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1030.580112][T16551] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:35 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:35 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x0) 03:30:35 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f004800, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:35 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0a00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000c80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:35 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, 0x0, 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:35 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0c00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1031.061629][T16571] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000e80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1031.123096][T16572] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:35 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f004c00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:35 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000f80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:35 executing program 1: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa101bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000001080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1031.640921][T16590] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:36 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:36 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f005407, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:36 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0d00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:36 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440), 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:36 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000006080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000586580200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:36 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0e00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1032.059579][T16604] FAULT_INJECTION: forcing a failure. [ 1032.059579][T16604] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1032.086707][T16605] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1032.133929][T16604] CPU: 0 PID: 16604 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1032.145643][T16604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1032.155725][T16604] Call Trace: [ 1032.159013][T16604] [ 1032.161940][T16604] dump_stack_lvl+0x136/0x150 [ 1032.166654][T16604] should_fail_ex+0x4a3/0x5b0 [ 1032.171348][T16604] _copy_from_user+0x30/0x190 [ 1032.176059][T16604] copy_msghdr_from_user+0x89/0x150 [ 1032.181466][T16604] ? __copy_msghdr+0x4b0/0x4b0 [ 1032.186275][T16604] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 1032.192312][T16604] ? find_held_lock+0x2d/0x110 [ 1032.197134][T16604] ___sys_sendmsg+0xdd/0x1b0 [ 1032.201760][T16604] ? do_recvmmsg+0x6e0/0x6e0 [ 1032.206377][T16604] ? __fget_files+0x248/0x480 [ 1032.211064][T16604] ? lock_downgrade+0x690/0x690 [ 1032.215932][T16604] ? trace_lock_acquire+0x12d/0x180 [ 1032.221143][T16604] ? receive_fd+0x110/0x110 [ 1032.225854][T16604] ? lock_acquire+0x32/0xc0 [ 1032.230386][T16604] ? receive_fd+0x110/0x110 [ 1032.234932][T16604] ? __fget_files+0x26a/0x480 [ 1032.239690][T16604] ? __fget_light+0xe5/0x270 [ 1032.244427][T16604] __sys_sendmsg+0xf7/0x1c0 [ 1032.248984][T16604] ? __sys_sendmsg_sock+0x40/0x40 [ 1032.254069][T16604] ? fput+0x2f/0x1a0 [ 1032.258040][T16604] ? ksys_write+0x1a3/0x250 [ 1032.262696][T16604] ? syscall_enter_from_user_mode+0x26/0x80 [ 1032.268658][T16604] ? lockdep_hardirqs_on+0x7d/0x100 [ 1032.273868][T16604] do_syscall_64+0x39/0xb0 [ 1032.278285][T16604] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1032.284185][T16604] RIP: 0033:0x7f7e1968c169 [ 1032.288598][T16604] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1032.308216][T16604] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1032.316643][T16604] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1032.324607][T16604] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1032.332570][T16604] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1032.340534][T16604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1032.348514][T16604] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1032.356502][T16604] 03:30:36 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f006000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:36 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000008180200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:37 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b0f00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000ffffa88880200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1032.956965][T16629] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:37 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:37 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b1800b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:37 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000ffffff9e80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:37 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440), 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:37 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f006800, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:37 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000003a680200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1033.158586][T16637] FAULT_INJECTION: forcing a failure. [ 1033.158586][T16637] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1033.196577][T16637] CPU: 0 PID: 16637 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 03:30:37 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b1a00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1033.208282][T16637] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1033.218457][T16637] Call Trace: [ 1033.221758][T16637] [ 1033.224704][T16637] dump_stack_lvl+0x136/0x150 [ 1033.229416][T16637] should_fail_ex+0x4a3/0x5b0 [ 1033.234134][T16637] _copy_from_user+0x30/0x190 [ 1033.238894][T16637] __import_iovec+0x55f/0x880 [ 1033.243618][T16637] ? __might_fault+0xb2/0x190 [ 1033.248353][T16637] ? __might_fault+0xb2/0x190 [ 1033.253087][T16637] import_iovec+0x110/0x160 [ 1033.257641][T16637] copy_msghdr_from_user+0xed/0x150 [ 1033.262887][T16637] ? __copy_msghdr+0x4b0/0x4b0 [ 1033.267695][T16637] ? find_held_lock+0x2d/0x110 [ 1033.272509][T16637] ___sys_sendmsg+0xdd/0x1b0 [ 1033.277148][T16637] ? do_recvmmsg+0x6e0/0x6e0 [ 1033.281783][T16637] ? __fget_files+0x248/0x480 [ 1033.286513][T16637] ? lock_downgrade+0x690/0x690 [ 1033.291420][T16637] ? trace_lock_acquire+0x12d/0x180 [ 1033.296669][T16637] ? receive_fd+0x110/0x110 [ 1033.301226][T16637] ? lock_acquire+0x32/0xc0 [ 1033.305795][T16637] ? receive_fd+0x110/0x110 [ 1033.310333][T16637] ? __fget_files+0x26a/0x480 [ 1033.315043][T16637] ? __fget_light+0xe5/0x270 [ 1033.319667][T16637] __sys_sendmsg+0xf7/0x1c0 [ 1033.324187][T16637] ? __sys_sendmsg_sock+0x40/0x40 [ 1033.329231][T16637] ? fput+0x2f/0x1a0 [ 1033.333144][T16637] ? syscall_enter_from_user_mode+0x26/0x80 [ 1033.339054][T16637] ? lockdep_hardirqs_on+0x7d/0x100 [ 1033.344267][T16637] do_syscall_64+0x39/0xb0 [ 1033.348704][T16637] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1033.354611][T16637] RIP: 0033:0x7f7e1968c169 [ 1033.359036][T16637] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1033.378653][T16637] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1033.387079][T16637] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1033.395061][T16637] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1033.403052][T16637] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1033.411028][T16637] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1033.419003][T16637] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1033.426997][T16637] 03:30:37 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 3) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:38 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b1b00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1033.529518][T16638] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:38 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000fffffff080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:38 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f006c00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1033.905777][T16656] FAULT_INJECTION: forcing a failure. [ 1033.905777][T16656] name failslab, interval 1, probability 0, space 0, times 0 [ 1033.978363][T16656] CPU: 1 PID: 16656 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1033.990054][T16656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1034.000130][T16656] Call Trace: [ 1034.003421][T16656] [ 1034.006359][T16656] dump_stack_lvl+0x136/0x150 [ 1034.011063][T16656] should_fail_ex+0x4a3/0x5b0 [ 1034.015755][T16656] should_failslab+0x9/0x20 [ 1034.020271][T16656] kmem_cache_alloc_node+0x5c/0x3e0 [ 1034.025492][T16656] __alloc_skb+0x288/0x330 [ 1034.029944][T16656] ? __napi_build_skb+0x50/0x50 [ 1034.034809][T16656] ? __netlink_dump_start+0x910/0x910 [ 1034.040265][T16656] ? apparmor_socket_getpeersec_dgram+0x9/0x10 [ 1034.046456][T16656] netlink_sendmsg+0x9b0/0xe30 [ 1034.051276][T16656] ? netlink_unicast+0x7f0/0x7f0 [ 1034.056234][T16656] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1034.061540][T16656] ? netlink_unicast+0x7f0/0x7f0 [ 1034.066494][T16656] sock_sendmsg+0xde/0x190 [ 1034.070924][T16656] ____sys_sendmsg+0x71c/0x900 [ 1034.075719][T16656] ? copy_msghdr_from_user+0xfc/0x150 [ 1034.081104][T16656] ? kernel_sendmsg+0x50/0x50 [ 1034.085795][T16656] ? find_held_lock+0x2d/0x110 [ 1034.090600][T16656] ___sys_sendmsg+0x110/0x1b0 [ 1034.095307][T16656] ? do_recvmmsg+0x6e0/0x6e0 [ 1034.099967][T16656] ? __fget_files+0x248/0x480 [ 1034.104666][T16656] ? lock_downgrade+0x690/0x690 [ 1034.109533][T16656] ? trace_lock_acquire+0x12d/0x180 [ 1034.114746][T16656] ? receive_fd+0x110/0x110 [ 1034.119265][T16656] ? lock_acquire+0x32/0xc0 [ 1034.123780][T16656] ? receive_fd+0x110/0x110 [ 1034.128319][T16656] ? __fget_files+0x26a/0x480 [ 1034.133042][T16656] ? __fget_light+0xe5/0x270 [ 1034.137668][T16656] __sys_sendmsg+0xf7/0x1c0 [ 1034.142183][T16656] ? __sys_sendmsg_sock+0x40/0x40 [ 1034.147249][T16656] ? syscall_enter_from_user_mode+0x26/0x80 [ 1034.153172][T16656] ? lockdep_hardirqs_on+0x7d/0x100 [ 1034.158379][T16656] do_syscall_64+0x39/0xb0 [ 1034.162812][T16656] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1034.168720][T16656] RIP: 0033:0x7f7e1968c169 [ 1034.173145][T16656] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1034.192843][T16656] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1034.201267][T16656] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1034.209250][T16656] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1034.217226][T16656] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1034.225205][T16656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1034.233197][T16656] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1034.241191][T16656] 03:30:38 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x0, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:38 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b2300b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:38 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000088a8ffff80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:38 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b2500b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:40 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440), 0x0) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:40 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 4) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:40 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000f0ffff80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:40 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f007400, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:40 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b2800b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:40 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x0, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:41 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000007fffffff80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:41 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 5) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1036.515929][T16682] validate_nla: 1 callbacks suppressed [ 1036.515942][T16682] netlink: 'syz-executor.0': attribute type 10 has an invalid length. 03:30:41 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b2900b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:41 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b3700b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1036.644075][T16690] FAULT_INJECTION: forcing a failure. [ 1036.644075][T16690] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1036.866947][T16690] CPU: 1 PID: 16690 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1036.878646][T16690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1036.888715][T16690] Call Trace: [ 1036.892014][T16690] [ 1036.894961][T16690] dump_stack_lvl+0x136/0x150 [ 1036.899686][T16690] should_fail_ex+0x4a3/0x5b0 [ 1036.904387][T16690] ? __might_fault+0xb2/0x190 [ 1036.909099][T16690] copyin+0x1b/0x140 [ 1036.913010][T16690] _copy_from_iter+0x1dc/0x1260 [ 1036.917887][T16690] ? __build_skb_around+0x276/0x3a0 [ 1036.923127][T16690] ? _copy_from_iter_nocache+0x1080/0x1080 [ 1036.929131][T16690] ? __napi_build_skb+0x50/0x50 [ 1036.934004][T16690] ? __netlink_dump_start+0x910/0x910 [ 1036.939389][T16690] ? __virt_addr_valid+0x61/0x2e0 [ 1036.944470][T16690] ? __phys_addr+0xc8/0x140 [ 1036.948993][T16690] ? __phys_addr_symbol+0x30/0x70 [ 1036.954060][T16690] ? __check_object_size+0x323/0x730 [ 1036.959369][T16690] netlink_sendmsg+0x883/0xe30 [ 1036.964156][T16690] ? netlink_unicast+0x7f0/0x7f0 [ 1036.969134][T16690] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1036.974458][T16690] ? netlink_unicast+0x7f0/0x7f0 [ 1036.979424][T16690] sock_sendmsg+0xde/0x190 [ 1036.983857][T16690] ____sys_sendmsg+0x71c/0x900 [ 1036.988642][T16690] ? copy_msghdr_from_user+0xfc/0x150 [ 1036.994027][T16690] ? kernel_sendmsg+0x50/0x50 [ 1036.998819][T16690] ? find_held_lock+0x2d/0x110 [ 1037.003607][T16690] ___sys_sendmsg+0x110/0x1b0 [ 1037.008303][T16690] ? do_recvmmsg+0x6e0/0x6e0 [ 1037.012910][T16690] ? __fget_files+0x248/0x480 [ 1037.017612][T16690] ? lock_downgrade+0x690/0x690 [ 1037.022496][T16690] ? trace_lock_acquire+0x12d/0x180 [ 1037.027713][T16690] ? receive_fd+0x110/0x110 [ 1037.032242][T16690] ? lock_acquire+0x32/0xc0 [ 1037.036931][T16690] ? receive_fd+0x110/0x110 [ 1037.041496][T16690] ? __fget_files+0x26a/0x480 [ 1037.046207][T16690] ? __fget_light+0xe5/0x270 [ 1037.050826][T16690] __sys_sendmsg+0xf7/0x1c0 [ 1037.055343][T16690] ? __sys_sendmsg_sock+0x40/0x40 [ 1037.060400][T16690] ? syscall_enter_from_user_mode+0x26/0x80 [ 1037.066486][T16690] ? lockdep_hardirqs_on+0x7d/0x100 [ 1037.071706][T16690] do_syscall_64+0x39/0xb0 [ 1037.076150][T16690] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1037.082065][T16690] RIP: 0033:0x7f7e1968c169 [ 1037.086496][T16690] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1037.106127][T16690] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e 03:30:41 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000009effffff80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1037.114562][T16690] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1037.122540][T16690] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1037.130885][T16690] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1037.139228][T16690] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1037.147309][T16690] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1037.155304][T16690] 03:30:41 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b3800b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:43 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{0x0}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:43 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 6) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:43 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f007a00, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:43 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x0, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:43 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000f0ffffff80200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:43 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b3d00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:43 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b3e00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:43 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000e000000200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1039.312359][T16711] FAULT_INJECTION: forcing a failure. [ 1039.312359][T16711] name failslab, interval 1, probability 0, space 0, times 0 03:30:44 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 7) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1039.402273][T16711] CPU: 0 PID: 16711 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 03:30:44 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000002000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1039.402345][T16711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1039.402361][T16711] Call Trace: [ 1039.402370][T16711] [ 1039.402380][T16711] dump_stack_lvl+0x136/0x150 [ 1039.402427][T16711] should_fail_ex+0x4a3/0x5b0 [ 1039.402454][T16711] ? lock_sync+0x190/0x190 [ 1039.402491][T16711] should_failslab+0x9/0x20 [ 1039.402515][T16711] kmem_cache_alloc+0x63/0x3b0 [ 1039.402555][T16711] skb_clone+0x172/0x3c0 [ 1039.402589][T16711] netlink_deliver_tap+0xb2f/0xcf0 [ 1039.402627][T16711] netlink_unicast+0x5f9/0x7f0 [ 1039.402661][T16711] ? netlink_attachskb+0x890/0x890 [ 1039.402686][T16711] ? __virt_addr_valid+0x61/0x2e0 [ 1039.402726][T16711] ? __phys_addr_symbol+0x30/0x70 [ 1039.402764][T16711] ? __check_object_size+0x323/0x730 [ 1039.402797][T16711] netlink_sendmsg+0x925/0xe30 [ 1039.402832][T16711] ? netlink_unicast+0x7f0/0x7f0 [ 1039.402866][T16711] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1039.402893][T16711] ? netlink_unicast+0x7f0/0x7f0 [ 1039.402920][T16711] sock_sendmsg+0xde/0x190 [ 1039.402947][T16711] ____sys_sendmsg+0x71c/0x900 [ 1039.402973][T16711] ? copy_msghdr_from_user+0xfc/0x150 [ 1039.403004][T16711] ? kernel_sendmsg+0x50/0x50 [ 1039.403036][T16711] ? find_held_lock+0x2d/0x110 [ 1039.403076][T16711] ___sys_sendmsg+0x110/0x1b0 [ 1039.403108][T16711] ? do_recvmmsg+0x6e0/0x6e0 [ 1039.403142][T16711] ? __fget_files+0x248/0x480 [ 1039.403178][T16711] ? lock_downgrade+0x690/0x690 [ 1039.403210][T16711] ? trace_lock_acquire+0x12d/0x180 [ 1039.403244][T16711] ? receive_fd+0x110/0x110 [ 1039.403278][T16711] ? lock_acquire+0x32/0xc0 [ 1039.403319][T16711] ? receive_fd+0x110/0x110 [ 1039.403362][T16711] ? __fget_files+0x26a/0x480 [ 1039.403409][T16711] ? __fget_light+0xe5/0x270 [ 1039.403455][T16711] __sys_sendmsg+0xf7/0x1c0 [ 1039.403487][T16711] ? __sys_sendmsg_sock+0x40/0x40 [ 1039.403535][T16711] ? syscall_enter_from_user_mode+0x26/0x80 [ 1039.403567][T16711] ? lockdep_hardirqs_on+0x7d/0x100 03:30:44 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f00f000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1039.403597][T16711] do_syscall_64+0x39/0xb0 [ 1039.403632][T16711] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1039.403666][T16711] RIP: 0033:0x7f7e1968c169 [ 1039.403687][T16711] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1039.403711][T16711] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1039.403739][T16711] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1039.403758][T16711] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1039.403776][T16711] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1039.403793][T16711] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 03:30:44 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="0a00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1039.403809][T16711] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1039.403845][T16711] [ 1039.404168][T16711] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1039.521651][T16715] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1040.046971][T16732] netlink: 'syz-executor.0': attribute type 10 has an invalid length. [ 1040.047061][T16736] FAULT_INJECTION: forcing a failure. [ 1040.047061][T16736] name failslab, interval 1, probability 0, space 0, times 0 03:30:44 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{0x0}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) [ 1040.047732][T16736] CPU: 1 PID: 16736 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1040.047766][T16736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1040.047782][T16736] Call Trace: 03:30:44 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) (fail_nth: 8) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:44 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:44 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:44 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="0f00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1040.047789][T16736] [ 1040.047798][T16736] dump_stack_lvl+0x136/0x150 03:30:44 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000004000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1040.047827][T16736] should_fail_ex+0x4a3/0x5b0 [ 1040.047846][T16736] should_failslab+0x9/0x20 [ 1040.047860][T16736] __kmem_cache_alloc_node+0x5b/0x320 [ 1040.047882][T16736] ? rtnl_newlink+0x4a/0xa0 [ 1040.047946][T16736] kmalloc_trace+0x26/0xe0 [ 1040.047969][T16736] rtnl_newlink+0x4a/0xa0 [ 1040.047984][T16736] ? __rtnl_newlink+0x1840/0x1840 [ 1040.047998][T16736] rtnetlink_rcv_msg+0x43d/0xd50 [ 1040.048015][T16736] ? rtnl_stats_set+0x4d0/0x4d0 [ 1040.048029][T16736] ? __dev_queue_xmit+0xa38/0x3c20 [ 1040.048057][T16736] netlink_rcv_skb+0x165/0x440 [ 1040.048072][T16736] ? rtnl_stats_set+0x4d0/0x4d0 [ 1040.048087][T16736] ? netlink_ack+0x1360/0x1360 [ 1040.048112][T16736] ? netlink_deliver_tap+0x1b1/0xcf0 [ 1040.048131][T16736] netlink_unicast+0x547/0x7f0 [ 1040.048149][T16736] ? netlink_attachskb+0x890/0x890 [ 1040.048163][T16736] ? __virt_addr_valid+0x61/0x2e0 [ 1040.048184][T16736] ? __phys_addr_symbol+0x30/0x70 [ 1040.048204][T16736] ? __check_object_size+0x323/0x730 [ 1040.048221][T16736] netlink_sendmsg+0x925/0xe30 [ 1040.048238][T16736] ? netlink_unicast+0x7f0/0x7f0 [ 1040.048256][T16736] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1040.048270][T16736] ? netlink_unicast+0x7f0/0x7f0 [ 1040.048284][T16736] sock_sendmsg+0xde/0x190 [ 1040.048298][T16736] ____sys_sendmsg+0x71c/0x900 [ 1040.048312][T16736] ? copy_msghdr_from_user+0xfc/0x150 [ 1040.048328][T16736] ? kernel_sendmsg+0x50/0x50 [ 1040.048344][T16736] ? find_held_lock+0x2d/0x110 [ 1040.048365][T16736] ___sys_sendmsg+0x110/0x1b0 [ 1040.048381][T16736] ? do_recvmmsg+0x6e0/0x6e0 [ 1040.048399][T16736] ? __fget_files+0x248/0x480 [ 1040.048418][T16736] ? lock_downgrade+0x690/0x690 [ 1040.048435][T16736] ? trace_lock_acquire+0x12d/0x180 [ 1040.048452][T16736] ? receive_fd+0x110/0x110 [ 1040.048470][T16736] ? lock_acquire+0x32/0xc0 [ 1040.048485][T16736] ? receive_fd+0x110/0x110 [ 1040.048506][T16736] ? __fget_files+0x26a/0x480 [ 1040.048529][T16736] ? __fget_light+0xe5/0x270 [ 1040.048552][T16736] __sys_sendmsg+0xf7/0x1c0 [ 1040.048567][T16736] ? __sys_sendmsg_sock+0x40/0x40 [ 1040.048592][T16736] ? syscall_enter_from_user_mode+0x26/0x80 [ 1040.048610][T16736] ? lockdep_hardirqs_on+0x7d/0x100 [ 1040.048632][T16736] do_syscall_64+0x39/0xb0 [ 1040.048653][T16736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1040.048673][T16736] RIP: 0033:0x7f7e1968c169 [ 1040.048686][T16736] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1040.048700][T16736] RSP: 002b:00007f7e1a363168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1040.048716][T16736] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1968c169 [ 1040.048726][T16736] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 [ 1040.048735][T16736] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1040.048744][T16736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.048753][T16736] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 03:30:45 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b4400b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:45 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="1000000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1040.048776][T16736] [ 1040.280116][T16742] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1040.676150][T16742] FAULT_INJECTION: forcing a failure. [ 1040.676150][T16742] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1040.740844][T16742] CPU: 0 PID: 16742 Comm: syz-executor.1 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1040.752546][T16742] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1040.762654][T16742] Call Trace: [ 1040.765951][T16742] [ 1040.768907][T16742] dump_stack_lvl+0x136/0x150 [ 1040.773633][T16742] should_fail_ex+0x4a3/0x5b0 [ 1040.778347][T16742] _copy_to_user+0x30/0x160 [ 1040.782882][T16742] simple_read_from_buffer+0xd0/0x160 [ 1040.788290][T16742] proc_fail_nth_read+0x18b/0x220 [ 1040.793351][T16742] ? proc_fault_inject_read+0x220/0x220 [ 1040.798930][T16742] ? security_file_permission+0xaf/0xd0 [ 1040.804528][T16742] vfs_read+0x28d/0x960 [ 1040.808725][T16742] ? proc_fault_inject_read+0x220/0x220 [ 1040.814330][T16742] ? kernel_read+0x1c0/0x1c0 [ 1040.818956][T16742] ? receive_fd+0x110/0x110 [ 1040.823500][T16742] ? __fget_files+0x26a/0x480 [ 1040.828228][T16742] ksys_read+0x12b/0x250 [ 1040.832506][T16742] ? vfs_write+0xe40/0xe40 [ 1040.836960][T16742] ? syscall_enter_from_user_mode+0x26/0x80 [ 1040.842898][T16742] do_syscall_64+0x39/0xb0 [ 1040.847349][T16742] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1040.853277][T16742] RIP: 0033:0x7f7e1963df8c [ 1040.857717][T16742] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48 [ 1040.877389][T16742] RSP: 002b:00007f7e1a363160 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 03:30:45 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b4500b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:45 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000005000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1040.885830][T16742] RAX: ffffffffffffffda RBX: 00007f7e197abf80 RCX: 00007f7e1963df8c [ 1040.893823][T16742] RDX: 000000000000000f RSI: 00007f7e1a3631e0 RDI: 0000000000000004 [ 1040.901816][T16742] RBP: 00007f7e1a3631d0 R08: 0000000000000000 R09: 0000000000000000 [ 1040.909814][T16742] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1040.917805][T16742] R13: 00007ffedef1bdbf R14: 00007f7e1a363300 R15: 0000000000022000 [ 1040.925827][T16742] 03:30:45 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2500000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:45 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000006000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1041.233447][T16771] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.0'. 03:30:47 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{0x0}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:47 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:47 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000007000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:47 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b4800b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:47 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="3000000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:47 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:47 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000002, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:47 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000008000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1043.158115][T16777] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="4001000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000009000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:48 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b4d00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1043.562789][T16796] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000a000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:48 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:48 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000003, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="c00e000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:48 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5000b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000c000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1043.804507][T16813] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:48 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:48 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5a00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000e000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="e03f030010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:48 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000004, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:48 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900010000000000000f000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1044.084247][T16824] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:48 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5b00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:48 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000005, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:48 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="effdffff10008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000010000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:48 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5d00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1044.263024][T16842] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:49 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:49 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000006, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:49 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000001008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:49 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5e00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:49 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000060000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:49 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:49 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000002008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:49 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000f0000080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:49 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b5f00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1045.107848][T16853] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:49 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000007, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:49 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000030080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:49 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b6300b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1045.292289][T16874] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:50 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:50 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:50 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000003008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:50 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000008, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000a6030080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:50 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051b9b00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000050080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:50 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000009, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:50 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc02b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1046.135917][T16893] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:50 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000004008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:50 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000060080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1046.314723][T16902] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:50 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00000a, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1046.561074][T16911] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:51 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:51 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:51 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc03b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000070080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:51 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000005008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:51 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00000c, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:51 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc05b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:51 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00000e, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:51 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000090080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:51 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000006008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:51 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc06b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:51 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00000f, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:52 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) 03:30:52 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc07b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000a0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:52 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000007008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:52 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000010, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:52 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000c0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:52 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000008008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:52 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00002a, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:52 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc08b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:52 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000e0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:52 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000009008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1048.250970][T16967] validate_nla: 4 callbacks suppressed [ 1048.250990][T16967] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:53 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) 03:30:53 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000a008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:53 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc09b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:53 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000048, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000190001000000000000000f0080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:53 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9c", 0x93}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000065580080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1049.080838][T16986] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:53 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0ab2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:53 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000600080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:53 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000b008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:53 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00004c, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:53 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0bb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1049.600524][T17004] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:54 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) 03:30:54 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000060, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:54 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0cb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:54 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70ea468767506ecf4c4b853a0e2e45c7072de028f45cce2b9c", 0x93}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:54 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000c008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000058650080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000810080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:54 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000068, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1050.048991][T17018] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:54 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000d008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:54 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0db2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000003a60080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1050.207183][T17029] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:55 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00006c, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1050.571576][T17038] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:55 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x0, 0x0) 03:30:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000e008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:55 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000074, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000f00080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:55 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0eb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:55 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000000081200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:55 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc0fb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:55 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e0000000f008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1051.031382][T17051] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:55 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000020080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:55 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f00007a, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:55 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc10b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1051.543874][T17068] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:56 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x0, 0x0) 03:30:56 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc18b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e02000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000030080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:56 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f0000f0, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:56 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:56 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000300, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000040080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) [ 1051.983045][T17081] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:56 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc1ab2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e03000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:56 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000050080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:56 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e04000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) [ 1052.127761][T17094] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:57 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x0, 0x0) 03:30:57 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000500, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:57 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc1bb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000060080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e05000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:57 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d3", 0x62}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:57 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000551, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:57 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc30b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:57 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000070080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:57 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e06000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:57 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000600, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:57 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc3eb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) [ 1053.357431][T17134] validate_nla: 2 callbacks suppressed [ 1053.357449][T17134] netlink: 'syz-executor.1': attribute type 10 has an invalid length. 03:30:58 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e07000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000080080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:58 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000700, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) 03:30:58 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc9bb2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:58 executing program 2: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007c1830e12e73c28269e142f8696316857dc0af18890a1cf9b8935cfaf8fe49a832025af7aaa9d59ad5107cc8f38f8da570d2979d86f6f9e05e46b940f2f15bf4dccc096508cc9da3f30b52130abdd0fa129c6c6488a65368de5a9726ebd6a8ef032def69c128b399aaab7714c90a34f8746713dbb516f94d5109e016123f9c4d6d4018921ca77d2b49fbef77063efb92fa87b6c7eac8c898a3fa9ebc7717cbb066802a0bc4bf86ea34a781b4eb", @ANYRESHEX, @ANYRES32], &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r0}, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2408d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831d4b67589abdb7967eacb64ca751351334cca2bcb08a09d006c63874f7891fcc96a83cc3a695f7f21065f6ff1ea8382d387af5a96600cf66187741e99a30b10be978c504ce94fc21e70", 0x7b}], 0x1) memfd_secret(0x80000) openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x680c80, 0x101) r2 = dup(0xffffffffffffffff) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) signalfd4(r2, &(0x7f0000000100), 0x8, 0x0) unshare(0x6c060000) 03:30:58 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000c80)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000019000100000000000000090080200000000400050000000008000300", @ANYRES32], 0x24}}, 0x0) 03:30:58 executing program 3: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) sched_setscheduler(r0, 0x5, &(0x7f0000000500)=0x8) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) prlimit64(r1, 0xb, &(0x7f0000000540)={0x4, 0x3}, &(0x7f0000000580)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f00000000c0)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB='upperdir=./bus,workdir=./file1,lowerdir=./file0']) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)=@random={'user.', 'overlay\x00'}) chdir(&(0x7f0000000200)='./bus\x00') fcntl$dupfd(r2, 0x406, r3) r4 = open(&(0x7f0000000000)='./bus\x00', 0x181042, 0x0) write$P9_RREADDIR(r4, &(0x7f0000000100)=ANY=[], 0xbf) (fail_nth: 1) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000002040)=ANY=[@ANYRES16=r4], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000), 0x10}, 0x80) creat(&(0x7f0000000480)='./file0/file0\x00', 0x11c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendfile(r4, r4, &(0x7f0000000240)=0x10, 0x7f10) lsetxattr$security_capability(&(0x7f0000000400)='./file2\x00', &(0x7f0000001540), &(0x7f00000003c0)=@v3={0x3000000, [{0x102}, {0x7, 0x46}]}, 0x18, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 03:30:58 executing program 0: bpf$MAP_CREATE(0x100000000000000, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) timer_create(0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) mkdir(&(0x7f00000000c0)='./file0\x00', 0x42) mount(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000040)='./file2\x00', 0x181042, 0x0) sendfile(r1, r1, 0x0, 0x7f06) unlinkat(r1, &(0x7f0000000340)='./file0\x00', 0x0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x10c) r3 = openat$cgroup_procs(r2, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) writev(r3, &(0x7f0000000440)=[{&(0x7f0000000180)='0', 0x1}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat(r2, 0x0, 0x44c01, 0x10) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000300)=0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x3f000000, &(0x7f0000000180)=[{&(0x7f0000000000)="2e09000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) 03:30:58 executing program 4: mkdir(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) open(0x0, 0x0, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(0xffffffffffffffff, 0x4b66, 0x0) writev(r0, &(0x7f0000000440)=[{&(0x7f0000000500)="29fa051bbc00b2088d7a542c7a317991df607cb270eb30f5963c98735923186bdc9ede8ed521900e3192e3f880990e6a0831", 0x32}], 0x1) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000000000)='0', 0xfffffd2c) 03:30:58 executing program 1: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x3f000900, &(0x7f0000000180)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c0000000000000e000a001400000002800000121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0xffffffff, &(0x7f0000000100)=[{&(0x7f00000000c0)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x14) [ 1054.121081][T17148] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1054.259328][T17161] netlink: 'syz-executor.1': attribute type 10 has an invalid length. [ 1054.290297][T17162] FAULT_INJECTION: forcing a failure. [ 1054.290297][T17162] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 1054.290436][T17162] CPU: 0 PID: 17162 Comm: syz-executor.3 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1054.290468][T17162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1054.290484][T17162] Call Trace: [ 1054.290492][T17162] [ 1054.290502][T17162] dump_stack_lvl+0x136/0x150 [ 1054.290551][T17162] should_fail_ex+0x4a3/0x5b0 [ 1054.290582][T17162] prepare_alloc_pages+0x178/0x570 [ 1054.290632][T17162] __alloc_pages+0x149/0x4a0 [ 1054.290672][T17162] ? __alloc_pages_slowpath.constprop.0+0x2170/0x2170 [ 1054.290725][T17162] ? filemap_get_entry+0x203/0x430 [ 1054.290761][T17162] ? lock_downgrade+0x690/0x690 [ 1054.290805][T17162] alloc_pages+0x1aa/0x270 [ 1054.290843][T17162] folio_alloc+0x20/0x70 [ 1054.290878][T17162] filemap_alloc_folio+0x3ad/0x450 [ 1054.290914][T17162] ? trace_mm_filemap_delete_from_page_cache+0x190/0x190 [ 1054.290948][T17162] ? ext4_xattr_security_set+0x50/0x50 [ 1054.291003][T17162] ? __vfs_getxattr+0x140/0x1a0 [ 1054.291041][T17162] __filemap_get_folio+0x2a6/0x990 [ 1054.291079][T17162] ext4_da_write_begin+0x466/0x8b0 [ 1054.291118][T17162] ? ext4_write_begin+0x1020/0x1020 [ 1054.291158][T17162] generic_perform_write+0x256/0x570 [ 1054.291194][T17162] ? generic_file_readonly_mmap+0x180/0x180 [ 1054.291223][T17162] ? iunique+0x370/0x370 [ 1054.291259][T17162] ext4_buffered_write_iter+0x15b/0x460 [ 1054.291299][T17162] ext4_file_write_iter+0xbe0/0x1740 [ 1054.291338][T17162] ? aa_file_perm+0x592/0x1250 [ 1054.291374][T17162] ? ext4_file_mmap+0x6c0/0x6c0 [ 1054.291421][T17162] do_iter_readv_writev+0x20b/0x3b0 [ 1054.291459][T17162] ? generic_copy_file_range+0x1d0/0x1d0 [ 1054.291501][T17162] ? bpf_lsm_file_permission+0x9/0x10 [ 1054.291532][T17162] ? security_file_permission+0xaf/0xd0 [ 1054.291571][T17162] do_iter_write+0x185/0x7e0 [ 1054.291603][T17162] ? rcu_is_watching+0x12/0xb0 [ 1054.291646][T17162] vfs_iter_write+0x74/0xa0 [ 1054.291680][T17162] ovl_write_iter+0x96f/0x12b0 [ 1054.291735][T17162] ? ovl_splice_write+0x730/0x730 [ 1054.291781][T17162] vfs_write+0xa1d/0xe40 [ 1054.291820][T17162] ? kernel_write+0x670/0x670 [ 1054.291851][T17162] ? receive_fd+0x110/0x110 [ 1054.291887][T17162] ? __fget_files+0x26a/0x480 [ 1054.291932][T17162] ksys_write+0x12b/0x250 [ 1054.291965][T17162] ? __ia32_sys_read+0xb0/0xb0 [ 1054.292000][T17162] ? syscall_enter_from_user_mode+0x26/0x80 [ 1054.292033][T17162] do_syscall_64+0x39/0xb0 [ 1054.292062][T17162] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1054.292091][T17162] RIP: 0033:0x7f1de048c169 [ 1054.292111][T17162] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1054.292132][T17162] RSP: 002b:00007f1de1278168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1054.292157][T17162] RAX: ffffffffffffffda RBX: 00007f1de05ac120 RCX: 00007f1de048c169 [ 1054.292174][T17162] RDX: 00000000000000bf RSI: 0000000020000100 RDI: 0000000000000006 [ 1054.292189][T17162] RBP: 00007f1de12781d0 R08: 0000000000000000 R09: 0000000000000000 [ 1054.292205][T17162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1054.292220][T17162] R13: 00007ffca96ec8df R14: 00007f1de1278300 R15: 0000000000022000 [ 1054.292253][T17162] [ 1054.292469][T17162] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN [ 1054.292495][T17162] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 1054.292512][T17162] CPU: 0 PID: 17162 Comm: syz-executor.3 Not tainted 6.3.0-rc6-next-20230414-syzkaller-12018-gd3f2cd248191 #0 [ 1054.292540][T17162] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 [ 1054.292554][T17162] RIP: 0010:folio_wait_stable+0x23/0xe0 [ 1054.292583][T17162] Code: 00 00 00 0f 1f 40 00 f3 0f 1e fa 55 48 89 fd 53 e8 82 93 d1 ff 48 8d 7d 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a4 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b [ 1054.292606][T17162] RSP: 0018:ffffc90018eef780 EFLAGS: 00010203 [ 1054.292623][T17162] RAX: dffffc0000000000 RBX: ffff8880745fbeb0 RCX: ffffc90013044000 [ 1054.292639][T17162] RDX: 0000000000000001 RSI: ffffffff81b1e30e RDI: 000000000000000c [ 1054.292652][T17162] RBP: fffffffffffffff4 R08: 0000000000000001 R09: ffffffff8c8f09d3 [ 1054.292666][T17162] R10: fffffbfff191e13a R11: 0000000000000000 R12: 0000000000000000 [ 1054.292679][T17162] R13: ffff8880745fc0d8 R14: 0000000000000000 R15: ffff8880745fbc50 [ 1054.292694][T17162] FS: 00007f1de1278700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 1054.292716][T17162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1054.292731][T17162] CR2: 00007f1de1277ff8 CR3: 0000000025d23000 CR4: 00000000003506f0 [ 1054.292745][T17162] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1054.292758][T17162] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1054.292772][T17162] Call Trace: [ 1054.292777][T17162] [ 1054.292785][T17162] ext4_da_write_begin+0x47f/0x8b0 [ 1054.292818][T17162] ? ext4_write_begin+0x1020/0x1020 [ 1054.292850][T17162] generic_perform_write+0x256/0x570 [ 1054.292880][T17162] ? generic_file_readonly_mmap+0x180/0x180 [ 1054.292906][T17162] ? iunique+0x370/0x370 [ 1054.292935][T17162] ext4_buffered_write_iter+0x15b/0x460 [ 1054.292970][T17162] ext4_file_write_iter+0xbe0/0x1740 [ 1054.293002][T17162] ? aa_file_perm+0x592/0x1250 [ 1054.293029][T17162] ? ext4_file_mmap+0x6c0/0x6c0 [ 1054.293065][T17162] do_iter_readv_writev+0x20b/0x3b0 [ 1054.293097][T17162] ? generic_copy_file_range+0x1d0/0x1d0 [ 1054.293130][T17162] ? bpf_lsm_file_permission+0x9/0x10 [ 1054.293158][T17162] ? security_file_permission+0xaf/0xd0 [ 1054.293191][T17162] do_iter_write+0x185/0x7e0 [ 1054.293241][T17162] ? rcu_is_watching+0x12/0xb0 [ 1054.293280][T17162] vfs_iter_write+0x74/0xa0 [ 1054.293313][T17162] ovl_write_iter+0x96f/0x12b0 [ 1054.293353][T17162] ? ovl_splice_write+0x730/0x730 [ 1054.293391][T17162] vfs_write+0xa1d/0xe40 [ 1054.293426][T17162] ? kernel_write+0x670/0x670 [ 1054.293456][T17162] ? receive_fd+0x110/0x110 [ 1054.293486][T17162] ? __fget_files+0x26a/0x480 [ 1054.293522][T17162] ksys_write+0x12b/0x250 [ 1054.293552][T17162] ? __ia32_sys_read+0xb0/0xb0 [ 1054.293584][T17162] ? syscall_enter_from_user_mode+0x26/0x80 [ 1054.293611][T17162] do_syscall_64+0x39/0xb0 [ 1054.293638][T17162] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1054.293667][T17162] RIP: 0033:0x7f1de048c169 [ 1054.293683][T17162] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 1054.293703][T17162] RSP: 002b:00007f1de1278168 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1054.293723][T17162] RAX: ffffffffffffffda RBX: 00007f1de05ac120 RCX: 00007f1de048c169 [ 1054.293737][T17162] RDX: 00000000000000bf RSI: 0000000020000100 RDI: 0000000000000006 [ 1054.293751][T17162] RBP: 00007f1de12781d0 R08: 0000000000000000 R09: 0000000000000000 [ 1054.293764][T17162] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1054.293777][T17162] R13: 00007ffca96ec8df R14: 00007f1de1278300 R15: 0000000000022000 [ 1054.293799][T17162] [ 1054.293805][T17162] Modules linked in: [ 1054.293822][T17162] ---[ end trace 0000000000000000 ]--- [ 1054.293832][T17162] RIP: 0010:folio_wait_stable+0x23/0xe0 [ 1054.293860][T17162] Code: 00 00 00 0f 1f 40 00 f3 0f 1e fa 55 48 89 fd 53 e8 82 93 d1 ff 48 8d 7d 18 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 a4 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b [ 1054.293885][T17162] RSP: 0018:ffffc90018eef780 EFLAGS: 00010203 [ 1054.293905][T17162] RAX: dffffc0000000000 RBX: ffff8880745fbeb0 RCX: ffffc90013044000 [ 1054.293923][T17162] RDX: 0000000000000001 RSI: ffffffff81b1e30e RDI: 000000000000000c [ 1054.293940][T17162] RBP: fffffffffffffff4 R08: 0000000000000001 R09: ffffffff8c8f09d3 [ 1054.293958][T17162] R10: fffffbfff191e13a R11: 0000000000000000 R12: 0000000000000000 [ 1054.293974][T17162] R13: ffff8880745fc0d8 R14: 0000000000000000 R15: ffff8880745fbc50 [ 1054.293992][T17162] FS: 00007f1de1278700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 [ 1054.294018][T17162] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1054.294036][T17162] CR2: 00007f1de1277ff8 CR3: 0000000025d23000 CR4: 00000000003506f0 [ 1054.294053][T17162] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1054.294067][T17162] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1054.294084][T17162] Kernel panic - not syncing: Fatal exception [ 1054.294240][T17162] Kernel Offset: disabled [ 1055.115724][T17162] Rebooting in 86400 seconds..